Why is information within the event log missing in Splunk after they are collected from the server?

[Gayathirikuppus]

We are using Windows infrastructure app to collect the windows event log.

In our criteria, we have the event logs getting into Splunk but some of the event code is missing.

Could you please let me know what are possible ways to troubleshoot this issue?

[alemarzu]

Hello there @Gayathirikuppusamy

• Have you check your auditing policys ? Perhaps the events you are expecting to see are not enabled on Windows.
• What about Windows Event Viewer? Did you find that particular EventCode in there?