All Apps and Add-ons
Highlighted

I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

Path Finder

I have installed the Splunk Add-on for Microsoft Windows and have below settings in inputs.conf, but I'm still unable to see the security logs. I checked on the Windows and Active Directory servers and the evtx logs exist.

[WinEventLog://Security]
disabled = 0
whitelist = 4625,4624,4634,4767
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=false
suppress_text = 1
0 Karma
Highlighted

Re: I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

Motivator

I'd ask the easy question first. Are you searching in index=wineventlog? Or have your role to search all internal indexes?

This response likely doesn't rate as an answer yet.

0 Karma
Highlighted

Re: I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

Engager

Hi!

Having same problem. WinEventLog://System is working on from the same inputs.conf file and I have winevetlog index available.

0 Karma
Highlighted

Re: I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

SplunkTrust
SplunkTrust

Couple of questions:

  • Which version of Splunk are you running?
  • Are you reading those events locally or remotely?
  • Is your service account local administrator or have you granted it at least permissions to read Security event logs? There's an Event Log Reader group should you want to use Domain account instead of local SYSTEM. This could be populated via GPOs if you don't want to implement this manually everywhere.

View solution in original post

Highlighted

Re: I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

Engager
  • Splunk 6.3
  • Winserver sends them to indexer
  • Local service account (Local System) is running the Forwarder. I created new "service account" ("splunkforwarder") and gave it enough rights to run the Forwarder. There are still Application and System logs coming in but no Security logs.
0 Karma
Highlighted

Re: I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

SplunkTrust
SplunkTrust

Hi, i don't get your last point.
There should only be one service on your server that is running your Splunk Universal Forwarder instance, is this running as LOCAL SYSTEM or as "splunkforwarder" user?

If the latter, could you try to give the user temporary local admin rights and then restart your Splunk service.

By default System and Application logs are less restrictive on Windows machines and local users should be able to read those even if they are not local administrators. Security logs tend to require extra rights.

0 Karma
Highlighted

Re: I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

Engager

Hi!

It was running as "Local System". I created "splunkforwarder" with local admins and log rights. At first I didn't get anything special so I made some Group Policy checks and left for home. During the night logs have started to come to indexer. Might've been a policy issue...?

Thanks for your help! 😃

0 Karma
Highlighted

Re: I've installed the Splunk Add-on for Microsoft Windows, but why am I unable to see WinEventLog:Security events?

SplunkTrust
SplunkTrust

I'm glad it works now.
By the way, could you accept one of the answers in order to fully close this question?

0 Karma