Getting Data In

Configuration for windows event logs

p_basanth
New Member

I want to monitor windows event logs and the below is the entries of inputs.conf file. But i am not able to view the data for this index. Can someone confirm if the format of entries is correct?

inputs.conf

[default]

host = myhost

[WinEventLog:Application]

disabled = 0

index = myindex

sourcetype = WinEventLog:Application

SourceName=myapplicationname

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

View solution in original post

0 Karma

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...