Windows Event IDs (Codes) logs are delayed for days. Latency varies, The delay reaches at times weeks or months. It is confirmed that none of the pipeline queues are blocked.
Note that the Event IDs are reached in real-time in the event viewer
How do the events get from Windows to Splunk? Is it via WMI or an installed forwarder? The latter is preferred. If a UF is used, is it always running?
Yes the Windows forwarded events from UF and I receive logs in real-time (running) from all inputs except (Events ID) which has a delay of months.
