All Apps and Add-ons

Windows TA

edwardrose
Contributor

Hello All,

 

I am trying to ingest some Azure data from our DCs.  I have the following two stanzas added to our Splunk_TA_windows inputs.conf and we still do not see any data and do not see any errors from any of the hosts that have the Azure data.

[WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Admin]
index = wineventlog
disabled = 0
renderXml=true

[WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Operational]
index = wineventlog
disabled = 0
renderXml=true

 

Not sure why we are not seeing any data in Splunk.  The AD admin says he sees logs on the host but not in Splunk.  So to me it seems that Splunk is not ingesting the data and I am lost as to why.

 

Thanks

Labels (2)
Tags (3)
0 Karma