How to name monitoring stanza in inputs.conf to pick up Windows Applications and Services Logs?

[sadkha]

Hello,

I am trying to onboard an ActiveRoles server, however it doesn't seem that I'm configuring my inputs.conf appropriately. The 'full name' in Event Viewer properties for the server reads, "EDM Server", and the file path reads, \Winevt\Logs\EDM Server.evtx.

any ideas on what I should name the monitoring stanza so I can pick up these logs?

Thank you!

PS: At the top of the Properties files it reads "Type: Administrative"- not sure if this matters.

[somesoni2]

Use the monitoring stanza with name if .evtx file. So for your example,

[WinEventLog://EDM Server]
disabled = 0 

[mlevsh]

Hi @sadkha , I understand it's 2 years after you've asked the question. But still curious if you were able to configure getting Active roles logs?

[sadkha]

that's what I've been using however unfortunately nothing is being pulled in.

Are you aware of any restrictions from the windows side that would prevent splunk from pulling in these logs?