Getting Data In

How to troubleshoot why Windows event logs are not making into the target index?

Path Finder

We are monitoring for specific Windows events on our Domain Controllers.
Inputs.conf looks like this:

disabled = 0
index = winevents
start_from = oldest
current_only = 0
checkpointInterval = 5
whitelist = 4728,4729,4732,4733,4756,4757,4755

Whe I add a test user to a universal security group, I trigger an event in the security log:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/11/2016 3:22:50 PM
Event ID:      4756
Task Category: Security Group Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      xxxxxxxxxxxx
A member was added to a security-enabled universal group.

    Security ID:        LONDON\xxxxxxxxxxxx
    Account Name:       xxxxxxx
    Account Domain:     LONDON
    Logon ID:       0x86xxxx

    Security ID:        LONDON\splunk_test
    Account Name:       CN=Splunk Test Log Generator UK,OU=xxx,OU=Test Area,OU=xxx,OU=OIAL,DC=xxx,DC=xxx,DC=xxx

    Security ID:        LONDON\xxxxxx
    Account Name:       xxxxxxxxxxxx
    Account Domain:     LONDON

Additional Information:
    Privileges:     -

Event Xml:

Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />

etc etc

But this event never makes it into the index.
No errors on the splunkd log.
What am i missing?

0 Karma


That seems to look right. What version of Splunk? Do you get any events from the dc in Splunk (internal events included)? Any other events from the event log on that dc? Any event log events from any forwarders? Where is your inputs.conf located?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...