Getting Data In

Is it possible to configure inputs.conf to forward events based on "Custom Views" in Microsoft Event Viewer?

merter
New Member

Hi Splunk Community,

Can one configure inputs.conf to forward events based on a "Custom Views" in Event Viewer?
Specifically, we are looking to forward the events Certification Authority events.
alt text

Thanks

0 Karma

javiergn
Super Champion

Take a look at my answer here (the nested one) in case that helps:

https://answers.splunk.com/answers/371126/is-it-possible-to-transport-data-from-a-windows-ev.html

In summary:

[WinEventLog://Path-To-Your-View]
disabled = 0
start_from = oldest
index = yourindexname

For example:

[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...