How to import sysmon logs to Splunk?

[onurasln55]

I choose source from forwarded input selection to input in splunk. I can't see sysmon in logs from source. I made the inputs.conf setting via forwarder, unfortunately I couldn't see it again. I have logs. There are forwarders. My other logs are coming. The sysmon log is not coming.

I would appreciate your help.

not sysmon log 

 

[onurasln55 · Accepted solution]

I found a solution by editing the inputs.conf file as follows.

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = false
renderXml = true
index= sysmon
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

[smurf]

Hi,

Did you check your default index? It would be main if you didn't change it.

smurf