Getting Data In

How can I make the sourcetype WinEventLog:Application active?

asorot
Engager

abl-bccwprhyb01 07/19/2017 22:17:10 sqleventlog WinEventLog:Application EPS INACTIVE (7-30days)

Source type WinEventLog:Application is inactive for sqlevent index

in error and warnings it showing no result found. that's why I am not able to check exactly what I need to check and where and how can I make this source type WinEventLog:Application active. Please help

joechakkola1
Explorer

in your inputs.conf add the stanza as shown below :

[WinEventLog://Application]
disabled = 0

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...