Getting Data In

Help with Windows Print Server admin log

tomtom0030
Loves-to-Learn

The print server OS is Windows Server 2019

 

I would like to get PrintService-Admin log to Splunk.

I tried the following in the input.conf of Universal Forwarder in print server.

[WinEventLog://Microsoft-Windows-PrintService/Admin]
disabled = 0
index = winps

Which is found in https://community.splunk.com/t5/Getting-Data-In/Microsoft-Windows-PrintService-Operational-Logs/m-p/...

But I cannot find any events from the index.

 

The log is enabled in the server, which is under Applications and Services Logs > Microsoft > Windows > PrintService

tomtom0030_0-1720122496496.png

tomtom0030_1-1720122510865.png

 

I also tried to set the data input from web console to monitor the log file in folder: C:\Windows\System32\winevt\Logs

 

With RegEx:

Microsoft\-Windows\-PrintService.+\.evtx

So i can get

Microsoft-Windows-PrintService%4Admin.evtx

AND

Microsoft-Windows-PrintService%4Operational.evtx

 

But also, no event is shown for the index.

Hope somebody can help with this.

Thanks

 

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. You can't get events directly from evtx files so don't even bother trying 😉 But seriously - UF uses system calls to query eventlog channels so no direct reading from the files is involved.

2. Are you getting _any_ eventlogs from this UF?

3. What user does your splunkd.exe run with? Did you adjust ACLs on the eventlogs? Did you grant the user with proper privileges?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...