We are using WMI to send Windows event logs to a Windows UF with Windows-TA installed/configured from deployment server. For the most part this is working as it should. However, we are finding an issue that occurs across multiple servers for various application and system event logs entries where field extraction is not occurring properly. On the UF events viewer, Windows Logs/Forwarded events, the event log fields/entries appear properly. However, when we do a search the fields are not there.
We took one of the Windows servers and installed the UF and Windows-TA app on it. In this set up, the fields for the same event log entry extract properly and are available in a search.
We've looked at a lot of conf files and no luck as of yet. Ideas?
