Getting Print Spooler Logs into Splunk

rmakjr0318 · ‎11-09-2021

We need to get Windows Print Spooler logs into splunk but not sure where to start. The specific event codes are generated and viewable from Windows Event Viewer (Applications and Services\Microsoft\Windows\PrintService\Operational) codes 307 and 800. If anyone can point me in the right direction that would be great. Thanks!

SilverWolf8 · ‎11-19-2024

Was this successful? Would the Splunk Security Essentials Add-on work too?

isoutamo · ‎11-10-2021

Hi

I think that you should use this https://splunkbase.splunk.com/app/742/ & https://docs.splunk.com/Documentation/AddOns/released/Windows/AbouttheSplunkAdd-onforWindows

There seems to be own part for printer monitoring too.

r. Ismo

Getting Print Spooler Logs into Splunk

indexer

source

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

Join the Conversation

Getting Print Spooler Logs into Splunk

indexer

source

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...