Getting Data In

How to name monitoring stanza in inputs.conf to pick up Windows Applications and Services Logs?

Path Finder


I am trying to onboard an ActiveRoles server, however it doesn't seem that I'm configuring my inputs.conf appropriately. The 'full name' in Event Viewer properties for the server reads, "EDM Server", and the file path reads, \Winevt\Logs\EDM Server.evtx.

any ideas on what I should name the monitoring stanza so I can pick up these logs?

Thank you!

PS: At the top of the Properties files it reads "Type: Administrative"- not sure if this matters.

0 Karma

Revered Legend

Use the monitoring stanza with name if .evtx file. So for your example,

[WinEventLog://EDM Server]
disabled = 0 


Hi @sadkha , I understand it's 2 years after you've asked the question. But still curious if you were able to configure getting Active roles logs?

0 Karma

Path Finder

that's what I've been using however unfortunately nothing is being pulled in.

Are you aware of any restrictions from the windows side that would prevent splunk from pulling in these logs?

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...