Getting Data In

Help with inputs.conf Stanza for the Azure AD MFA NPS Extension

arfee_splunker
Explorer

Hi all

Getting this message : 

ERROR ExecProcessor [3700 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-AzureMfa-AuthZ/AuthZAdminCh'

I've tried numerous combinations in the stanza such as : 

WinEventLog://Microsoft-AzureMfa-AuthZ/AuthZAdminCh

WinEventLog://Microsoft-AzureMfa-AuthZ-AuthZAdminCh

WinEventLog://Microsoft/AzureMfa/AuthZ/AuthZAdminCh

The Windows Event Log chain for the AuthZAdminCh source is in the attachment.  Just not quite sure where I'm going wrong. 

Appreciate some advice.

 

Labels (3)
0 Karma
1 Solution

arfee_splunker
Explorer

Powershell (get-winevent -listlog *).logname revealed that the channel is simply called "AuthZAdminCh"

( despite hierarchical ordering under Microsoft-AzureMfa-AuthZ as presented in Event viewer )

The proven stanza  is as simple as : [WinEventLog://AuthZAdminCh

 

View solution in original post

0 Karma

arfee_splunker
Explorer

AuthZAdminCh.JPG

0 Karma

arfee_splunker
Explorer

Powershell (get-winevent -listlog *).logname revealed that the channel is simply called "AuthZAdminCh"

( despite hierarchical ordering under Microsoft-AzureMfa-AuthZ as presented in Event viewer )

The proven stanza  is as simple as : [WinEventLog://AuthZAdminCh

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...