Need help to monitor event logs from Kaspersky Security Centre in #Splunk. Merely pointing forwarder to collect Windows Logs on the Kaspersky Server doesn't help.
Please suggest.
Cheers, Mitesh Vohra.
I figured it out. The solution is to add a section and stanza in the inputs.conf file on UF-end.
[WinEventLogs: Kaspersky Event Logs] disabled = 0 start_from = oldest
Then, restart the SplunkForwarder Service.
Cheers. Mitesh.
View solution in original post
Kaspersky stores data in ms sql. From there, you can take data.
