Getting Data In

How to name monitoring stanza in inputs.conf to pick up Windows Applications and Services Logs?

Path Finder


I am trying to onboard an ActiveRoles server, however it doesn't seem that I'm configuring my inputs.conf appropriately. The 'full name' in Event Viewer properties for the server reads, "EDM Server", and the file path reads, \Winevt\Logs\EDM Server.evtx.

any ideas on what I should name the monitoring stanza so I can pick up these logs?

Thank you!

PS: At the top of the Properties files it reads "Type: Administrative"- not sure if this matters.

0 Karma

Revered Legend

Use the monitoring stanza with name if .evtx file. So for your example,

[WinEventLog://EDM Server]
disabled = 0 


Hi @sadkha , I understand it's 2 years after you've asked the question. But still curious if you were able to configure getting Active roles logs?

0 Karma

Path Finder

that's what I've been using however unfortunately nothing is being pulled in.

Are you aware of any restrictions from the windows side that would prevent splunk from pulling in these logs?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...