Deployment Architecture

The Universal Forwarder and Server 2008 Event Logs

peasead
Path Finder

Server 2008 has several different event logs beyond Security, System, and Application.

The Universal Forwarder only has those three check boxes (Security, System, and Application)...do you just add the additional logs as a monitored directory or file?

Are there any talks about a Server 2008 version that has all the additional log types?

0 Karma
1 Solution

Ayn
Legend

Those are just the default ones. You can certainly add any log sources you want by adding it in yourself in an inputs.conf file. Have a look at the default ones in etc\apps\MSIcreated\default\props.conf (or might it be local? I forget) and use those as templates. Simplest case for adding an eventlog with the name foo, for instance, would be to add this to an inputs.conf:

[WinEventLog:foo]

View solution in original post

Ayn
Legend

Those are just the default ones. You can certainly add any log sources you want by adding it in yourself in an inputs.conf file. Have a look at the default ones in etc\apps\MSIcreated\default\props.conf (or might it be local? I forget) and use those as templates. Simplest case for adding an eventlog with the name foo, for instance, would be to add this to an inputs.conf:

[WinEventLog:foo]
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...