WinEventLog:Security/Application/System events are going to perfmon index

[sarmstrong_splu]

When using the TA-DNSServer-NT6 TA from the Splunk for AD app (1.2.0) on a DC, the windows events from that server are not going into the 'winevents' index as they should be, instead going to the 'perfmon' index.

[sarmstrong_splu]

The issue appears to a comment that was left in the default/inputs.conf file. I've filed bug MSAPP-1200 to get it fixed for the next update. Removing this comment and restarting the instance resolves the issue.

#
# Perfmon Collection
#[perfmon://Processor]      <----- This is the issue.
object = Processor
counters = *
instances = *
interval = 10
disabled = 0
index=perfmon

[perfmon://Memory]
object = Memory
counters = *
interval = 10
disabled = 0
index=perfmon

[perfmon://Network_Interface]
object = Network Interface
counters = *
instances = *
interval = 10
disabled = 0
index=perfmon

[perfmon://DNS]
object = DNS
counters = *
interval = 10
disabled = 0
index=perfmon