Right now, we have Splunk setup to monitor Print Jobs. However, the print title in Event Viewer simply shows up as "Document X". We are trying to figure out how to get Event Viewer and subsequently Splunk to show the actual title of the Document which is printed.
I have added the //Jobs stanza into the input.conf file on the print server, but unfortunately I am not seeing the user field.
Please let me know if you have any recommendations.