Getting Data In

Help with Windows Print Server admin log

tomtom0030
Loves-to-Learn

The print server OS is Windows Server 2019

 

I would like to get PrintService-Admin log to Splunk.

I tried the following in the input.conf of Universal Forwarder in print server.

[WinEventLog://Microsoft-Windows-PrintService/Admin]
disabled = 0
index = winps

Which is found in https://community.splunk.com/t5/Getting-Data-In/Microsoft-Windows-PrintService-Operational-Logs/m-p/...

But I cannot find any events from the index.

 

The log is enabled in the server, which is under Applications and Services Logs > Microsoft > Windows > PrintService

tomtom0030_0-1720122496496.png

tomtom0030_1-1720122510865.png

 

I also tried to set the data input from web console to monitor the log file in folder: C:\Windows\System32\winevt\Logs

 

With RegEx:

Microsoft\-Windows\-PrintService.+\.evtx

So i can get

Microsoft-Windows-PrintService%4Admin.evtx

AND

Microsoft-Windows-PrintService%4Operational.evtx

 

But also, no event is shown for the index.

Hope somebody can help with this.

Thanks

 

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. You can't get events directly from evtx files so don't even bother trying 😉 But seriously - UF uses system calls to query eventlog channels so no direct reading from the files is involved.

2. Are you getting _any_ eventlogs from this UF?

3. What user does your splunkd.exe run with? Did you adjust ACLs on the eventlogs? Did you grant the user with proper privileges?

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 3)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...