How can I make the sourcetype WinEventLog:Applicat...

asorot · ‎08-17-2017

abl-bccwprhyb01 07/19/2017 22:17:10 sqleventlog WinEventLog:Application EPS INACTIVE (7-30days)

Source type WinEventLog:Application is inactive for sqlevent index

in error and warnings it showing no result found. that's why I am not able to check exactly what I need to check and where and how can I make this source type WinEventLog:Application active. Please help

joechakkola1 · ‎07-29-2018

in your inputs.conf add the stanza as shown below :

[WinEventLog://Application]
disabled = 0

How can I make the sourcetype WinEventLog:Application active?

Reduce and Transform Your Firewall Data with Splunk Data Management

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Are you a member of the Splunk Community?

How can I make the sourcetype WinEventLog:Application active?

Reduce and Transform Your Firewall Data with Splunk Data Management

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions