Getting Data In

Help with Windows Print Server admin log

tomtom0030
Loves-to-Learn

The print server OS is Windows Server 2019

 

I would like to get PrintService-Admin log to Splunk.

I tried the following in the input.conf of Universal Forwarder in print server.

[WinEventLog://Microsoft-Windows-PrintService/Admin]
disabled = 0
index = winps

Which is found in https://community.splunk.com/t5/Getting-Data-In/Microsoft-Windows-PrintService-Operational-Logs/m-p/...

But I cannot find any events from the index.

 

The log is enabled in the server, which is under Applications and Services Logs > Microsoft > Windows > PrintService

tomtom0030_0-1720122496496.png

tomtom0030_1-1720122510865.png

 

I also tried to set the data input from web console to monitor the log file in folder: C:\Windows\System32\winevt\Logs

 

With RegEx:

Microsoft\-Windows\-PrintService.+\.evtx

So i can get

Microsoft-Windows-PrintService%4Admin.evtx

AND

Microsoft-Windows-PrintService%4Operational.evtx

 

But also, no event is shown for the index.

Hope somebody can help with this.

Thanks

 

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. You can't get events directly from evtx files so don't even bother trying 😉 But seriously - UF uses system calls to query eventlog channels so no direct reading from the files is involved.

2. Are you getting _any_ eventlogs from this UF?

3. What user does your splunkd.exe run with? Did you adjust ACLs on the eventlogs? Did you grant the user with proper privileges?

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...