Getting Data In

Configuration for windows event logs

p_basanth
New Member

I want to monitor windows event logs and the below is the entries of inputs.conf file. But i am not able to view the data for this index. Can someone confirm if the format of entries is correct?

inputs.conf

[default]

host = myhost

[WinEventLog:Application]

disabled = 0

index = myindex

sourcetype = WinEventLog:Application

SourceName=myapplicationname

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

View solution in original post

0 Karma

Ayn
Legend

Looks right, except the last line - not sure what the idea is there. That shouldn't stop the input from working though. Judging by the conf, your error does not lie there but elsewhere.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...