Getting Data In

How to edit my universal forwarder monitor stanza to index Active Directory server logs?

anaqvi
Explorer

I am trying to monitor the Active Directory Server for logs. I have a universal forwarder installed on a Windows AD Server, and there are logs at the following path:

%SystemRoot%\System32\Winevt\Logs\

How can I monitor it? I have tried the following, but it does not work:

[monitor://%SystemRoot%/System32\Winevt\Logs]
targetDC = hqdc06
baseline = false
disabled = 0
index = wineventlog
renderXml=false
Sourcetype = Active Directory
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi anaqvi,
probably the problem is the slash (/) after %SystemRoot%.
Every way, aren't you able to define %SystemRoot%?

Bye.
Giuseppe

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!