Getting Data In

How to troubleshoot why my Windows universal forwarder stopped forwarding Windows application event logs?

peter_gianusso
Communicator

Recently my Windows Universal Forwarder stopped forwarding Windows application event log messages to my indexer. Seems to have stopped for all of the Windows application event logs it was forwarding.

Where is that activity logged or a better way to troubleshoot it? I looked in the splunkd.log files, from when it worked and when it stopped working, and cannot find any messages related to forwarding Windows event logs. There are no log messages from it worked. There are no log messages since it stopped working.

I don't recall doing any upgrades. No security changes were made that I am aware of.

It does not seem to be a WMI problem per say. I can use Splunk to use WMI to get WIndows performance counters such as disk space, CPU, etc

Thanks!

0 Karma
1 Solution

peter_gianusso
Communicator

Seems to have something to do with the use of current_only = 1. I removed that and everything started working again.

View solution in original post

0 Karma

peter_gianusso
Communicator

Seems to have something to do with the use of current_only = 1. I removed that and everything started working again.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!