No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational

[budimaos]

Hello,

I have the following entry on the inputs.conf on the Universal Forwarder App to collect all the windows task scheduler log:

[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
disabled = false
sourcetype = WinEvent:TS
index=prd_xxx

and I have the following entry on the HF app props.conf just to route them to the correct index cluster

[WinEventLog:TaskScheduler]
TRANSFORMS-routing = routeMe
disabled=false

Other logs on the same server with the same routing are coming in just fine, but I don't see a single event for the task scheduler even though we can see new events on the event viewer every minute or so.

There's no error message on the splunkd.log, and I can see the following entry on the metrics.log

06-20-2019 22:20:57.646 +1000 INFO Metrics - group=per_sourcetype_thruput, series="wineventlog:microsoft-windows-taskscheduler/operational", kbps=0.259293, eps=1.032258, kb=8.038086, ev=32, avg_age=1.000000, max_age=1

So I suppose it should have been coming in somewhere, but I just couldn't find it. It's not there on the target index nor the default index. Now I'm not entirely sure if it's actually being read.

The splunkforwarder is already running as a "Local System" on the box and we're using v6.1.1 at the moment.

Any idea please?

[hrawat]

How is routeC2 defined in transforms.conf?