Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How do I ingest the details tab in Windows Forward...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a server that received forwarded event logs from clients within my Enterprise. The event logs are simple to retrieve via the below standard inputs.conf stanza:
[WinEventLog://ForwardedEvents]
index = redacted
current_only=1
evt_resolve_ad_obj=0
renderXml=1
disabled=0
When the event logs come into Splunk, they only show EventCode, EventType, ComputerName, User, Sid, SidType, TaskCategory, OpCode, RecordNumber, Keywords, and Message (which is blank). The meat of the log that I need to see is in the details tab (if you're viewing it from Event Viewer in Windows). There's a friendly view and an XML view. Either one of the two detailed views I'd be fine with ingesting. However, Splunk is not ingesting these details. When looking in the XML view, there are two tags within : and . It appears Splunk is only capturing the data and not the that has the meat and potatoes of the log that I need. How do I get this data? I've been doing some searching and found a possible solution using scripted inputs with Wevtutil, but no documentation on how to use that within inputs.conf. I was hoping for an easier solution.
Any help would be greatly appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It turns out the issue was that our forwarders were version 6.1. We needed to upgrade to at least 6.2 to take full advantage of the render XML feature on the universal forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you find any solution? Currently experiencing the same issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@euroccp This question has two answers, one of them accepted. If neither answer helps you, please post a new question describing your problem.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It turns out the issue was that our forwarders were version 6.1. We needed to upgrade to at least 6.2 to take full advantage of the render XML feature on the universal forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We use the Splunk add-on app for Windows. Splunk_TA_Windows.
https://splunkbase.splunk.com/app/742/
With some tweaking. But it is a good inputs, transforms and props.conf. If anything, you can download, extract it and have a peek at the .conf files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[WinEventLog://ForwardedEvents]
disabled = false
start_from = oldest
current_only = 0
checkpointInterval = 5
index =
renderXml=false
This seems to be working for us if you wanted to give it a shot.
Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)
From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...
Application management with Targeted Application Install for Victoria Experience
