How do I monitor Forwarded Events logs on Windows?

[ericlarsen]

I'm trying to monitor Forwarded Events logs on Windows (not application, system, etc.)?

My inputs.conf stanza looks like this:

[WinEventLog://Forwarded Events]

Doesn't seem to work. Anyone had success monitoring this type of event log?

Any help would be much appreciated.
Thanks!

[TStrauch · Accepted solution]

Hi ericlarsen,

just try this. Ignore the Space between "Forwarded Events".

[WinEventLog://ForwardedEvents]
index= YOUR_INDEX
disabled = 0

regards

[ericlarsen]

Unfortunately that did not fix the issue.

[TStrauch]

Then you have a problem on any other place.

Example from the official inputs.conf documentation of Splunk.

Monitor Windows event logs ForwardedEvents, this time only gathering the
events happening after first starting to monitor, going forward in time.

[WinEventLog://ForwardedEvents]
disabled = 0
start_from = oldest
current_only = 1
batch_size = 10
checkpointInterval = 5

ignoring the extra parameter this is the right stanza for the inputs.conf.

[ericlarsen]

Not sure why, but it works now. Thanks!

[ericlarsen]

For those curious, I figured out why it just started suddenly working. I didn't have 'Restart Splunk' selected for the app on the Deployment Manager.

Again, TStrauch, thanks for the help with the monitor stanza.

[ericlarsen]

I don't want to monitor System event logs, I want to monitor Forwarded Events event logs.

I know the UF is working because I can search other data from the same server.

[skoelpin]

Try adding the sourcetype and index in the stanza so it looks like this..

[WinEventLog://System]
index = YOUR_INDEX
sourcetype = winEventLogs

Also, do you have the outputs.conf pointing to your indexer?