Getting Data In

Configuration for windows event logs

p_basanth
New Member

I want to monitor windows event logs and the below is the entries of inputs.conf file. But i am not able to view the data for this index. Can someone confirm if the format of entries is correct?

inputs.conf

[default]

host = myhost

[WinEventLog:Application]

disabled = 0

index = myindex

sourcetype = WinEventLog:Application

SourceName=myapplicationname

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

View solution in original post

0 Karma

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...