Getting Data In

How to pull in Windows Event logs from the Windows PowerShell path

TheBravoSierra
Path Finder

Hi,

I'm trying to pull in Windows Event logs from the Windows PowerShell path. This path includes 800s, which I've seen in event viewer so I know they're generated and stored here. I just can't seem to pull anything and I don't see much help on the internet to pulling this path.

This is my inputs.conf: 

[WinEventLog://Windows PowerShell/]
disabled=0

 

Note: This is different from the other PowerShell path where I get my 4103 and 4104 codes: 

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled=0

 

Any helps is appreciated. Thanks.

Labels (1)
0 Karma
1 Solution

TheBravoSierra
Path Finder

My inputs.conf was incorrect. I had a / at the end of PowerShell. Removed the / and now it is ingesting properly. 

View solution in original post

0 Karma

TheBravoSierra
Path Finder

My inputs.conf was incorrect. I had a / at the end of PowerShell. Removed the / and now it is ingesting properly. 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You have to get a proper path from the Event Log properties.

You seem to have a right one in the second case (Microsoft-Windows-PowerShell/Operational).

But the first one doesn't seem right. Check the properties of this log in Event Viewer and see its Full Name

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...