Event Monitoring dashboard not showing events

[jeremyhagand61]

Hi,

I've installed and configured this app (v6.0) in a test environment with logs from three Windows servers being indexed into the "wineventlog" index. I can see the events being indexed, Event Monitoring dashboard isn't showing any events.

The input lookup which is supposed to be populating the "Log Name" field isn't returning any results.

When I go to "Tools and Settings > Customise Features' I see that the "Event Monitoring" feature is not selected. I have selected it and clicked Save, but it keeps going back to unticked.

How can I troubleshoot this?

I have run the selection under Tools and Settings to generate the lookups and restarted Splunk

Splunk version 7.3.1
Splunk App for Windows Infra: 1.5.2
Splunk TA Windows: 6.0

Cheers,
Jeremy.

[jeremyhagand61 · Accepted solution]

I managed to fix this by changing the renderXml=true to false in every WinEventLog stanza of the inputs.conf.

This is documented here:
https://docs.splunk.com/Documentation/MSApp/1.5.2/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

All the wineventlog inputs (Windows, AD, and DNS) will have renderXml=true (Xml Format) by default. Make it false for all WinEventLog Inputs as XML data is not supported.

But it is very easy to miss. After I modified the inputs.conf and redistributed it I regenerated the lookups (Tools and Setting > Build Lookups) and all is happy.

[teak421]

This happened to me as well. Nice catch!

I wish that the inputs.conf file that comes with WindowsTA would have the correct defaults. Boy, that would save a ton of time!