Getting Data In

Failed to find Event Log

tmontney
Builder
[WinEventLog://Microsoft-Windows-DNS Client Events/Operational]
disabled = 0
index = wineventlog
interval = 60

What's wrong with this? I get the error in my splunk forwarder.

06-26-2017 12:16:31.997 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-DNS Client Events/Operational'

I wrote the log name as shown in Event Viewer, and it is enabled.

1 Solution

tmontney
Builder

Determined the correct channel name is Microsoft-Windows-DNS-Client/Operational. You can find the correct name by selecting an event, going to Details tab, under Friendly radio button, expand System and you'll see Channel.

View solution in original post

tmontney
Builder

Determined the correct channel name is Microsoft-Windows-DNS-Client/Operational. You can find the correct name by selecting an event, going to Details tab, under Friendly radio button, expand System and you'll see Channel.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...