Recently my Windows Universal Forwarder stopped forwarding Windows application event log messages to my indexer. Seems to have stopped for all of the Windows application event logs it was forwarding.
Where is that activity logged or a better way to troubleshoot it? I looked in the splunkd.log files, from when it worked and when it stopped working, and cannot find any messages related to forwarding Windows event logs. There are no log messages from it worked. There are no log messages since it stopped working.
I don't recall doing any upgrades. No security changes were made that I am aware of.
It does not seem to be a WMI problem per say. I can use Splunk to use WMI to get WIndows performance counters such as disk space, CPU, etc
Thanks!
