Getting Data In
Highlighted

How do I monitor Forwarded Events logs on Windows?

Path Finder

I'm trying to monitor Forwarded Events logs on Windows (not application, system, etc.)?

My inputs.conf stanza looks like this:

[WinEventLog://Forwarded Events]

Doesn't seem to work. Anyone had success monitoring this type of event log?

Any help would be much appreciated.
Thanks!

0 Karma
Highlighted

Re: How do I monitor Forwarded Events logs on Windows?

SplunkTrust
SplunkTrust

Try adding the sourcetype and index in the stanza so it looks like this..

[WinEventLog://System]
index = YOUR_INDEX
sourcetype = winEventLogs

Also, do you have the outputs.conf pointing to your indexer?

0 Karma
Highlighted

Re: How do I monitor Forwarded Events logs on Windows?

Path Finder

I don't want to monitor System event logs, I want to monitor Forwarded Events event logs.

alt text

I know the UF is working because I can search other data from the same server.

0 Karma
Highlighted

Re: How do I monitor Forwarded Events logs on Windows?

Communicator

Hi ericlarsen,

just try this. Ignore the Space between "Forwarded Events".

[WinEventLog://ForwardedEvents]
index= YOUR_INDEX
disabled = 0

regards

View solution in original post

Highlighted

Re: How do I monitor Forwarded Events logs on Windows?

Path Finder

Unfortunately that did not fix the issue.

0 Karma
Highlighted

Re: How do I monitor Forwarded Events logs on Windows?

Communicator

Then you have a problem on any other place.

Example from the official inputs.conf documentation of Splunk.

Monitor Windows event logs ForwardedEvents, this time only gathering the
events happening after first starting to monitor, going forward in time.

[WinEventLog://ForwardedEvents]
disabled = 0
startfrom = oldest
current
only = 1
batch_size = 10
checkpointInterval = 5

ignoring the extra parameter this is the right stanza for the inputs.conf.

0 Karma
Highlighted

Re: How do I monitor Forwarded Events logs on Windows?

Path Finder

Not sure why, but it works now. Thanks!

0 Karma
Highlighted

Re: How do I monitor Forwarded Events logs on Windows?

Path Finder

For those curious, I figured out why it just started suddenly working. I didn't have 'Restart Splunk' selected for the app on the Deployment Manager.

Again, TStrauch, thanks for the help with the monitor stanza.