Microsoft web application proxy log format inputs....

tarricop · ‎02-11-2021

I'm trying to configure my forwarder on a Windows server to send the Web Application Proxy logs. I'm using this format but it doesn't seem to be sending. I also added ADFS and that worked. Syntax is as follows:

[WinEventLog://AD FS/Admin]

disabled = 0

[WinEventLog://Web Application Proxy/Admin]

Disabled = 0

I couldn't find a documented list for all of the different windows logs. Any help would be appreciated.

jvsplunker · ‎10-27-2021

Did you ever figure out the [WinEventLog://Web Application Proxy/Admin] ? Wanting to splunk these logs as well.

Microsoft web application proxy log format inputs.conf

inputs.conf

universal forwarder

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Final Session of the Data Management & Federation Bootcamp Series

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation