Getting Data In

How to troubleshoot why my Windows universal forwarder stopped forwarding Windows application event logs?

peter_gianusso
Communicator

Recently my Windows Universal Forwarder stopped forwarding Windows application event log messages to my indexer. Seems to have stopped for all of the Windows application event logs it was forwarding.

Where is that activity logged or a better way to troubleshoot it? I looked in the splunkd.log files, from when it worked and when it stopped working, and cannot find any messages related to forwarding Windows event logs. There are no log messages from it worked. There are no log messages since it stopped working.

I don't recall doing any upgrades. No security changes were made that I am aware of.

It does not seem to be a WMI problem per say. I can use Splunk to use WMI to get WIndows performance counters such as disk space, CPU, etc

Thanks!

0 Karma
1 Solution

peter_gianusso
Communicator

Seems to have something to do with the use of current_only = 1. I removed that and everything started working again.

View solution in original post

0 Karma

peter_gianusso
Communicator

Seems to have something to do with the use of current_only = 1. I removed that and everything started working again.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...