Getting Data In

How to onboard Windows Key Management Service logs to Splunk?

thevikramyadav
Engager

Hi Splunker,

We are already onboarding Windows Event logs to Splunk, and with that now we also want to onboard windows Key Management Service logs to Splunk. Does anyone know how to onboard this type of log into Splunk?

Thanks in advance.

0 Karma

neerajs_81
Builder

Assuming, these are under Event Viewer ( For example: Event Viewer > Windows Logs > Applications and Services ) you need to add monitors like below in  the local inputs.conf of the Windows host in question.


Example: Below is the way we specify the path of the channel from EventViewer for sending over UAC logs.  This is to be defined under 

c:\program files\splunk forwarder\apps\splunk_TA_Windows\local\inputs.conf

[WinEventLog:Microsoft-Windows-UAC/Operational]
disabled = 0

 

You will have to adjust the path of the channel ( log folder) accordingly to where those KMS logs are stored..  Check this link for getting the path correct: 
 
https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/MonitorWindowseventlogdata#Use_the_Full_Name...

Note:  You can also get the path by right clicking on a sampe Event >> event properties >> Details >>  XML View >>  channel name

neerajs_81_0-1674636136584.png


Pls vote up or mark as Solution  if it helps

0 Karma

PickleRick
SplunkTrust
SplunkTrust

KMS seems to have its own event log. So just add a [wineventlog://Key Management Service] stanza with proper windows settings (sourcetype, destination index) and you should be ready to go.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...