How to forward Windows Event Viewer HPC Server logs with inputs.conf? ,

[mdu23]

I currently use inputs.conf file to forward Windows Event Viewer Application logs to Splunk via the following syntax:
[WinEventLog://Application]
disabled = 0

I'm wondering if anyone knows the Syntax to forward "Windows HPC Server" logs to Splunk?

Thanks!
Michael.

[p_gurav]

This may help:
https://social.microsoft.com/Forums/en-US/b72b13d7-24ca-4c57-941b-8b37da198be5/feed-hpc-logs-into-sp...

[mdu23]

Hi Gurav,

I think the way we send logs to Splunk is a little different to solution proposed by the Microsoft forum. We currently use AWS Cloud to spin up Windows Servers. We spend HPC logs via inputs.conf file linked to our Json code. The content of the inputs.conf file looks like:

[WinEventLog://Application]
disabled = 0

[WinEventLog://Security]
disabled = 0

[WinEventLog://System]
disabled = 0

I want to ask if anyone knows the Syntax for adding Window HPC Server logs to the inputs.conf file??? The actual Event Viewer logs in Windows can be found under: Event Viewer (Local) > Application and Services Logs > Windows HPC Server.

Thanks
Michael