All Apps and Add-ons

Why is information within the event log missing in Splunk after they are collected from the server?

Gayathirikuppus
New Member

We are using Windows infrastructure app to collect the windows event log.

In our criteria, we have the event logs getting into Splunk but some of the event code is missing.

Could you please let me know what are possible ways to troubleshoot this issue?

0 Karma

alemarzu
Motivator

Hello there @Gayathirikuppusamy

  • Have you check your auditing policys ? Perhaps the events you are expecting to see are not enabled on Windows.
  • What about Windows Event Viewer? Did you find that particular EventCode in there?
0 Karma