I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

[splunksurekha]

I have installed the Splunk Add-on for Microsoft Windows and have below settings in inputs.conf, but I'm still unable to see the security logs. I checked on the Windows and Active Directory servers and the evtx logs exist.

[WinEventLog://Security]
disabled = 0
whitelist = 4625,4624,4634,4767
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=false
suppress_text = 1

[javiergn · Accepted solution]

Couple of questions:

• Which version of Splunk are you running?
• Are you reading those events locally or remotely?
• Is your service account local administrator or have you granted it at least permissions to read Security event logs? There's an Event Log Reader group should you want to use Domain account instead of local SYSTEM. This could be populated via GPOs if you don't want to implement this manually everywhere.

[cnjokinee]

• Splunk 6.3
• Winserver sends them to indexer
• Local service account (Local System) is running the Forwarder. I created new "service account" ("splunkforwarder") and gave it enough rights to run the Forwarder. There are still Application and System logs coming in but no Security logs.

[javiergn]

Hi, i don't get your last point.
There should only be one service on your server that is running your Splunk Universal Forwarder instance, is this running as LOCAL SYSTEM or as "splunkforwarder" user?

If the latter, could you try to give the user temporary local admin rights and then restart your Splunk service.

By default System and Application logs are less restrictive on Windows machines and local users should be able to read those even if they are not local administrators. Security logs tend to require extra rights.

[cnjokinee]

Hi!

It was running as "Local System". I created "splunkforwarder" with local admins and log rights. At first I didn't get anything special so I made some Group Policy checks and left for home. During the night logs have started to come to indexer. Might've been a policy issue...?

Thanks for your help! 😃

[javiergn]

I'm glad it works now.
By the way, could you accept one of the answers in order to fully close this question?

[mikelanghorst]

I'd ask the easy question first. Are you searching in index=wineventlog? Or have your role to search all internal indexes?

This response likely doesn't rate as an answer yet.

[cnjokinee]

Hi!

Having same problem. WinEventLog://System is working on from the same inputs.conf file and I have winevetlog index available.