Deployment Architecture

Why I'm not see new host from added Universal Forwarder?

DimkoBilanko
Explorer

I have installed forwarder to a new Windows machine with default settings (with installed Splunk Add-on for Microsoft Windows and enabled WinEventLogs: system, security and Application). I see in Splunk (with installed Splunk Add-on for Microsoft Windows 4.8.0) that data is arrives, but I can't find any events in search with this host and even this host in hosts list. Even if I manually add settings to C:_Program Files_SplunkUniversalForwarder_etc_system_local_inputs.conf

[WinEventLog://Security]
disabled = 0
start_from = newest
index = wineventlog

Splunk v.6.3.0

Tags (1)
0 Karma

lguinn2
Legend

The most common reason for your problem is: you aren't looking in the right index. People often forget (I know I do) that your role might not automatically search a new index by default. And if it doesn't, the data won't show up in the data summary. The data summary only looks at indexes the user is allowed to search by defautlt. So try

index=* host=yourhostname

and see what you get!

0 Karma

DimkoBilanko
Explorer

Thanks Iguinn! But I thought, for me as builtin admin (with admin role) should be available all indexes by default.

0 Karma

lguinn2
Legend

That is not the default for the admin role!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...