Getting Data In

Application and Services Event Logs not appearing

aaronkorn
Splunk Employee
Splunk Employee

Hello,

We are trying to setup Splunk to monitor custom application event logs that are already added to the event viewer. Here is an example of the inputs.conf example we are using and we are running the service as system. Any ideas why it is not collecting these event logs?

[winEventLog:DBMApplicationEventLog]
disabled = 0
index = wineventlog
current_only = 1

[winEventLog:DBMBusinessEventLog]
disabled = 0
index = wineventlog
current_only = 1

alt text

0 Karma
1 Solution

MHibbin
Influencer

To be sure I would change your stanzas to use WinEventLog instead of winEventLog.

I would then look at the following documentation, as you may need to include the full path the event log:

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/MonitorWindowsdata#Event_log_monitor_configur...

I also assume you search starts with:

 index=wineventlog

Hope this helps.

View solution in original post

MHibbin
Influencer

To be sure I would change your stanzas to use WinEventLog instead of winEventLog.

I would then look at the following documentation, as you may need to include the full path the event log:

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/MonitorWindowsdata#Event_log_monitor_configur...

I also assume you search starts with:

 index=wineventlog

Hope this helps.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...