All Apps and Add-ons

Windows TA- Why are we not seeing any data in Splunk?


Hello All,


I am trying to ingest some Azure data from our DCs.  I have the following two stanzas added to our Splunk_TA_windows inputs.conf and we still do not see any data and do not see any errors from any of the hosts that have the Azure data.


index = wineventlog
disabled = 0

index = wineventlog
disabled = 0



Not sure why we are not seeing any data in Splunk.  The AD admin says he sees logs on the host but not in Splunk.  So to me it seems that Splunk is not ingesting the data and I am lost as to why.



Labels (2)
Tags (3)
0 Karma

Loves-to-Learn Lots


did anyone fix this issue?


0 Karma


Have you checked the firewall rules and a connectivity test?

Did you find anything in your internal logs?

0 Karma


Hey, did you find out solution?
I have same issue here?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...