Getting Data In

Configuration for windows event logs

p_basanth
New Member

I want to monitor windows event logs and the below is the entries of inputs.conf file. But i am not able to view the data for this index. Can someone confirm if the format of entries is correct?

inputs.conf

[default]

host = myhost

[WinEventLog:Application]

disabled = 0

index = myindex

sourcetype = WinEventLog:Application

SourceName=myapplicationname

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

View solution in original post

0 Karma

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...