Getting Data In

How to pull in Windows Event logs from the Windows PowerShell path

TheBravoSierra
Path Finder

Hi,

I'm trying to pull in Windows Event logs from the Windows PowerShell path. This path includes 800s, which I've seen in event viewer so I know they're generated and stored here. I just can't seem to pull anything and I don't see much help on the internet to pulling this path.

This is my inputs.conf: 

[WinEventLog://Windows PowerShell/]
disabled=0

 

Note: This is different from the other PowerShell path where I get my 4103 and 4104 codes: 

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled=0

 

Any helps is appreciated. Thanks.

Labels (1)
0 Karma
1 Solution

TheBravoSierra
Path Finder

My inputs.conf was incorrect. I had a / at the end of PowerShell. Removed the / and now it is ingesting properly. 

View solution in original post

0 Karma

TheBravoSierra
Path Finder

My inputs.conf was incorrect. I had a / at the end of PowerShell. Removed the / and now it is ingesting properly. 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You have to get a proper path from the Event Log properties.

You seem to have a right one in the second case (Microsoft-Windows-PowerShell/Operational).

But the first one doesn't seem right. Check the properties of this log in Event Viewer and see its Full Name

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...