Getting Print Spooler Logs into Splunk

[rmakjr0318]

We need to get Windows Print Spooler logs into splunk but not sure where to start. The specific event codes are generated and viewable from Windows Event Viewer (Applications and Services\Microsoft\Windows\PrintService\Operational) codes 307 and 800. If anyone can point me in the right direction that would be great. Thanks! 

[SilverWolf8]

Was this successful? Would the Splunk Security Essentials Add-on work too? 

[isoutamo]

Hi

I think that you should use this https://splunkbase.splunk.com/app/742/ & https://docs.splunk.com/Documentation/AddOns/released/Windows/AbouttheSplunkAdd-onforWindows

There seems to be own part for printer monitoring too.

r. Ismo