Correct Input Stanza for Windows 2003

ojay · ‎08-05-2021

Hi all,

I usually onboard Windows Server 2008 and newer but 2003 it is not working with below Stanza

# Windows platform specific input processor.
[WinEventLog://Application]
disabled = 0 
[WinEventLog://Security]
disabled = 0 
[WinEventLog://System]
disabled = 0

is it possible to read the files like this?

[monitor://C:\WINDOWS\System32\config\AppEvent.Evt]

Best,

N.

richgalloway · ‎08-05-2021

Splunk doesn't support Win2003. Perhaps you can find a third-party tool that can export the event log into a form Splunk can ingest.

---
If this reply helps you, Karma would be appreciated.

Correct Input Stanza for Windows 2003

inputs.conf

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Correct Input Stanza for Windows 2003

inputs.conf

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future