How to configure Splunk to aggregate security access event logs?

[presbia_Marc]

I was hoping that I could get security events with the forwarder. I installed the forwarder but all I am getting are system metrics. How do I configure this to do what I need for auditing purposes?

[presbia_Marc]

Yes, I turned on Auditing and I can see records being generated in the Security Log regarding access to folders, etc. The only records I am seeing in the tool on my standalone PC are like performance records. I installed the Forwarding Agent on the server. Maybe I need to configure that differently?

[adonio]

the doc linked in the answer below is great.
however, what are your "auditing purposes"? if its windows (assumed since you mentioned system), is your OS configured to capture these events e.g. windows security and audit rules turned on correctly? if linux, maybe auditd needed etc...
in any case, please elaborate / be more specific so we can better assist you
hope it helps

[woodcock]

Do this:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/MonitorWindowseventlogdata