Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to add Windows Event Log Adaxes.evtx as an inp...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have some folks that want me to ingest Adaxes events under: Application and Services Logs -> Adaxes
I'm not quite sure how to construct the inputs. The example below would just be a shot in the dark.
[WinEventLog://Applications and Services/Adaxes]
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried it?
Don't forget to add disabled=0 underneath it and you may need to add another / where there is only one?
Generally, I find that using UF's you are limited in choice to what is in the web interface on the HF when configuring from there, like app, sec and sys logs, no access to custom logs.
If you use a HF and get it to reach out directly via WMI or grab from local, you have more options and getting that input should be no problem.
If you're using inputs.conf then this link helps: http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/MonitorWindowseventlogdata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried it?
Don't forget to add disabled=0 underneath it and you may need to add another / where there is only one?
Generally, I find that using UF's you are limited in choice to what is in the web interface on the HF when configuring from there, like app, sec and sys logs, no access to custom logs.
If you use a HF and get it to reach out directly via WMI or grab from local, you have more options and getting that input should be no problem.
If you're using inputs.conf then this link helps: http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/MonitorWindowseventlogdata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
... This worked
[WinEventLog://Adaxes]
disabled = 0
Thank you.
Paul
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Community Badges!
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
