All Apps and Add-ons

Where does the Windows printer information pull data from?

davidcraven02
Communicator

My colleague has setup a Windows Printer App following the below link http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/MonitorWindowsprinterinformation

However, I am not too sure where the print events are being pulled from as after checking the Event Viewer (Windows > PrintService) some logs are empty or do not contain any printing logs so I am at a loss in understanding where they are pulled from. Does anyone know on a more low level detail how Splunk forwards these events?

Tags (2)
0 Karma

ansif
Motivator

Splunk WinPrintMon input calls an exe file called splunk-winprintmon.exe to get those inputs.Ensure that Print service is enabled in the server to get those data.

splunk-winprintmon.exe (available with UF) collects driver,ports and jobs details. It might not from events viewer.

0 Karma

davidcraven02
Communicator

Thank you for this but how do I check if the service is enabled ?

The actual issue is that when the user prints multiple pages it only shows 1 page being printed on both WinEvent logs as well as in splunk.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...