Failed to find Event Log

[tmontney]

[WinEventLog://Microsoft-Windows-DNS Client Events/Operational]
disabled = 0
index = wineventlog
interval = 60

What's wrong with this? I get the error in my splunk forwarder.

06-26-2017 12:16:31.997 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-DNS Client Events/Operational'

I wrote the log name as shown in Event Viewer, and it is enabled.

[tmontney · Accepted solution]

Determined the correct channel name is Microsoft-Windows-DNS-Client/Operational. You can find the correct name by selecting an event, going to Details tab, under Friendly radio button, expand System and you'll see Channel.