All Apps and Add-ons

I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

splunksurekha
Path Finder

I have installed the Splunk Add-on for Microsoft Windows and have below settings in inputs.conf, but I'm still unable to see the security logs. I checked on the Windows and Active Directory servers and the evtx logs exist.

[WinEventLog://Security]
disabled = 0
whitelist = 4625,4624,4634,4767
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=false
suppress_text = 1
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Couple of questions:

  • Which version of Splunk are you running?
  • Are you reading those events locally or remotely?
  • Is your service account local administrator or have you granted it at least permissions to read Security event logs? There's an Event Log Reader group should you want to use Domain account instead of local SYSTEM. This could be populated via GPOs if you don't want to implement this manually everywhere.

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Couple of questions:

  • Which version of Splunk are you running?
  • Are you reading those events locally or remotely?
  • Is your service account local administrator or have you granted it at least permissions to read Security event logs? There's an Event Log Reader group should you want to use Domain account instead of local SYSTEM. This could be populated via GPOs if you don't want to implement this manually everywhere.

cnjokinee
Engager
  • Splunk 6.3
  • Winserver sends them to indexer
  • Local service account (Local System) is running the Forwarder. I created new "service account" ("splunkforwarder") and gave it enough rights to run the Forwarder. There are still Application and System logs coming in but no Security logs.
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, i don't get your last point.
There should only be one service on your server that is running your Splunk Universal Forwarder instance, is this running as LOCAL SYSTEM or as "splunkforwarder" user?

If the latter, could you try to give the user temporary local admin rights and then restart your Splunk service.

By default System and Application logs are less restrictive on Windows machines and local users should be able to read those even if they are not local administrators. Security logs tend to require extra rights.

0 Karma

cnjokinee
Engager

Hi!

It was running as "Local System". I created "splunkforwarder" with local admins and log rights. At first I didn't get anything special so I made some Group Policy checks and left for home. During the night logs have started to come to indexer. Might've been a policy issue...?

Thanks for your help! 😃

0 Karma

javiergn
SplunkTrust
SplunkTrust

I'm glad it works now.
By the way, could you accept one of the answers in order to fully close this question?

0 Karma

mikelanghorst
Motivator

I'd ask the easy question first. Are you searching in index=wineventlog? Or have your role to search all internal indexes?

This response likely doesn't rate as an answer yet.

0 Karma

cnjokinee
Engager

Hi!

Having same problem. WinEventLog://System is working on from the same inputs.conf file and I have winevetlog index available.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...