Getting Data In

How to pull in Windows Event logs from the Windows PowerShell path

TheBravoSierra
Path Finder

Hi,

I'm trying to pull in Windows Event logs from the Windows PowerShell path. This path includes 800s, which I've seen in event viewer so I know they're generated and stored here. I just can't seem to pull anything and I don't see much help on the internet to pulling this path.

This is my inputs.conf: 

[WinEventLog://Windows PowerShell/]
disabled=0

 

Note: This is different from the other PowerShell path where I get my 4103 and 4104 codes: 

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled=0

 

Any helps is appreciated. Thanks.

Labels (1)
0 Karma
1 Solution

TheBravoSierra
Path Finder

My inputs.conf was incorrect. I had a / at the end of PowerShell. Removed the / and now it is ingesting properly. 

View solution in original post

0 Karma

TheBravoSierra
Path Finder

My inputs.conf was incorrect. I had a / at the end of PowerShell. Removed the / and now it is ingesting properly. 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You have to get a proper path from the Event Log properties.

You seem to have a right one in the second case (Microsoft-Windows-PowerShell/Operational).

But the first one doesn't seem right. Check the properties of this log in Event Viewer and see its Full Name

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...