Bitlocker Windows Events Inputs.conf

[aleckostiner123]

I'm trying to get bitlocker events into Splunk. Below is what I have in the inputs.conf and it appears to not be working.

[WinEventLog://Microsoft-Windows-BitLocker/BitLocker Management]
index = main
disabled = 0

[FlorianScho]

Hi, 
I know this post is quite old but anyway, here is my stanza which is working fine:

[WinEventLog://Microsoft-Windows-BitLocker/BitLocker Management]
index = windows
disabled = 0
renderXml = 1
evt_resolve_ad_obj= 1
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype=XmlWinEventLog

Did you check the Splunkd.log on you UF on start? Maybe the user running Splunk Forwarder Service is not able to access the logs.
Or there are just no logs available? On my site it is not written very frequently. 
The Splunk_TA_windows is also required on the UF.