I have the Windows Infrastructure app installed on a Windows machine. The monitor stanza and the powershell scripts are working fine, but the Winevent logs with the following config are not indexing any data.
[WinEventLog:DFS Replication] disabled=0 sourcetype="WinEventLog:DFS Replication" index=winevents queue=parsingQueue # Application and Services Logs - Directory Service [WinEventLog:Directory Service] disabled=0 sourcetype="WinEventLog:Directory Service" index=winevents queue=parsingQueue # Application and Services Logs - File Replication Service [WinEventLog:File Replication Service] disabled=0 sourcetype="WinEventLog:File Replication Service" index=winevents queue=parsingQueue
Please guide me where am I going wrong?
Two semi-general suggestions:
If it's installed on the local machine, is that local machine a Domain Controller?
You do have a "winevents" index on the indexer this gets sent to, right? If not, create that. I believe I had a problem where that app didn't create one of the indexes, though I don't recall which one. This could be your problem.
Thanks for replyin, yes I have the "winevents" index created, and the machine I want to gt events from is not a local machine. But i have deployed the DomainController App on the machine in question.
Kindly let me know if I am missing something. Any suggestions on this would be really helpful.
Well, something I noticed and I have no idea if it's a problem or not, but all my DCs have their various sourcetypes set with no spaces in it.
For instance, on the one I checked, C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DomainController-NT6\default\inputs.conf says:
[WinEventLog://File Replication Service] disabled=0 sourcetype=WinEventLog:File-Replication-Service index=wineventlog queue=parsingQueue
Try changing them to dashes and not spaces in those stanza and restart the UF?