All Apps and Add-ons
Highlighted

Why is information within the event log missing in Splunk after they are collected from the server?

New Member

We are using Windows infrastructure app to collect the windows event log.

In our criteria, we have the event logs getting into Splunk but some of the event code is missing.

Could you please let me know what are possible ways to troubleshoot this issue?

0 Karma
Highlighted

Re: Why is information within the event log missing in Splunk after they are collected from the server?

Motivator

Hello there @Gayathirikuppusamy

  • Have you check your auditing policys ? Perhaps the events you are expecting to see are not enabled on Windows.
  • What about Windows Event Viewer? Did you find that particular EventCode in there?
0 Karma