I'm trying to ingest Windows PrintService logs into our distributed environment. I've got a dedicated index, and have built an app with an inputs.conf with the following:
[WinEventLog://Microsoft-Windows-PrintService/Admin]
index = winprintlog
disabled = 0
start_from = oldest
The app is distributed via server class from our deployment server. I've confirmed the print servers have the app and the config file. I've restarted Splunk on the Deployment server, and manually restarted several forwarder services, but none of the servers are sending log data.
I don't know that there's been any new events since I deployed (they seem rare enough) but this same config was used on a custom Windows Powershell log app and it pulled all of the historical logs as well, of which there are plenty for the PrintService.
What am I missing?
