Getting Data In

No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational

budimaos
Engager

Hello,

I have the following entry on the inputs.conf on the Universal Forwarder App to collect all the windows task scheduler log:

[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
disabled = false
sourcetype = WinEvent:TS
index=prd_xxx

and I have the following entry on the HF app props.conf just to route them to the correct index cluster

[WinEventLog:TaskScheduler]
TRANSFORMS-routing = routeMe
disabled=false

Other logs on the same server with the same routing are coming in just fine, but I don't see a single event for the task scheduler even though we can see new events on the event viewer every minute or so.

There's no error message on the splunkd.log, and I can see the following entry on the metrics.log

06-20-2019 22:20:57.646 +1000 INFO Metrics - group=per_sourcetype_thruput, series="wineventlog:microsoft-windows-taskscheduler/operational", kbps=0.259293, eps=1.032258, kb=8.038086, ev=32, avg_age=1.000000, max_age=1

So I suppose it should have been coming in somewhere, but I just couldn't find it. It's not there on the target index nor the default index. Now I'm not entirely sure if it's actually being read.

The splunkforwarder is already running as a "Local System" on the box and we're using v6.1.1 at the moment.

Any idea please?

0 Karma

hrawat
Splunk Employee
Splunk Employee

How is routeC2 defined in transforms.conf?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...