I want to monitor Windows Servers — more specifically, application/security/system logs. Once I install the Universal Forwarder on the servers, can I just create a deployment app and put this in the inputs.conf file?
Windows platform specific input processor.
[WinEventLog://Application]
disabled = 0
index = win_servers
[WinEventLog://Security]
disabled = 0
index = win_servers
[WinEventLog://System]
disabled = 0
index = win_servers
[monitor://C:\Logging\dns_debug.log]
disabled = false
sourcetype = dns
[monitor://C:\Windows\System32\Dns\dns.log]
disabled = false
sourcetype = dns
We inherited a Splunk installation and there are several Splunk apps installed, everything is going to the "main" index, and I see a bunch of different sourcetypes defined :
XmlWinEventLog:Security (why would I use this over WinEventLog:Security?)
WinEventLog:Security
WinEventLog:Application
WinEventLog:System
I also noticed that the Splunk_TA_microsoft_ad created the windows,wineventlog, and winevents on the indexer. Are those even needed? Thanks.
