All Apps and Add-ons

Is there any configuration tricks concerning getting Windows Print Jobs into splunk?

scottrunyon
Contributor

We all know that Windows reporting and event logging are a complete mess, so this might not be a Splunk issue but I have to ask.

I have set up inputs.config to ingest Windows print jobs on a UF -
[WinPrintMon://jobs]
type=job
index=winprintmon

I am getting multiple copies of some events and only part of some events and missing some entirely. I noticed that the interval defaults to 60 seconds. There is a "special value" of 0, that forces this scripted input to be run continuously, If I would set the interval to 0, would this help? Or maybe making the interval longer, say interval=300, would decrease the duplicates?

As always, any help would be greatly appreciated so I can stopping pestering my Server Admin 🙂

Scott

0 Karma
1 Solution

Azeemering
Builder

I would actually increase the interval (600) and test what happens with that. Print servers are generally not too busy....
Also add baseline=0

View solution in original post

0 Karma

Azeemering
Builder

I would actually increase the interval (600) and test what happens with that. Print servers are generally not too busy....
Also add baseline=0

0 Karma

scottrunyon
Contributor

I am adding those to the config. Hopefully it works.

Scott

0 Karma

scottrunyon
Contributor

These changes didn't help.

I spoke with the system admin and after looking at the logs, he is opening a ticket with Microsoft.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...