Getting Data In

No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational

budimaos
Engager

Hello,

I have the following entry on the inputs.conf on the Universal Forwarder App to collect all the windows task scheduler log:

[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
disabled = false
sourcetype = WinEvent:TS
index=prd_xxx

and I have the following entry on the HF app props.conf just to route them to the correct index cluster

[WinEventLog:TaskScheduler]
TRANSFORMS-routing = routeMe
disabled=false

Other logs on the same server with the same routing are coming in just fine, but I don't see a single event for the task scheduler even though we can see new events on the event viewer every minute or so.

There's no error message on the splunkd.log, and I can see the following entry on the metrics.log

06-20-2019 22:20:57.646 +1000 INFO Metrics - group=per_sourcetype_thruput, series="wineventlog:microsoft-windows-taskscheduler/operational", kbps=0.259293, eps=1.032258, kb=8.038086, ev=32, avg_age=1.000000, max_age=1

So I suppose it should have been coming in somewhere, but I just couldn't find it. It's not there on the target index nor the default index. Now I'm not entirely sure if it's actually being read.

The splunkforwarder is already running as a "Local System" on the box and we're using v6.1.1 at the moment.

Any idea please?

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

How is routeC2 defined in transforms.conf?

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...