Getting Data In

No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational

budimaos
Engager

Hello,

I have the following entry on the inputs.conf on the Universal Forwarder App to collect all the windows task scheduler log:

[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
disabled = false
sourcetype = WinEvent:TS
index=prd_xxx

and I have the following entry on the HF app props.conf just to route them to the correct index cluster

[WinEventLog:TaskScheduler]
TRANSFORMS-routing = routeMe
disabled=false

Other logs on the same server with the same routing are coming in just fine, but I don't see a single event for the task scheduler even though we can see new events on the event viewer every minute or so.

There's no error message on the splunkd.log, and I can see the following entry on the metrics.log

06-20-2019 22:20:57.646 +1000 INFO Metrics - group=per_sourcetype_thruput, series="wineventlog:microsoft-windows-taskscheduler/operational", kbps=0.259293, eps=1.032258, kb=8.038086, ev=32, avg_age=1.000000, max_age=1

So I suppose it should have been coming in somewhere, but I just couldn't find it. It's not there on the target index nor the default index. Now I'm not entirely sure if it's actually being read.

The splunkforwarder is already running as a "Local System" on the box and we're using v6.1.1 at the moment.

Any idea please?

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

How is routeC2 defined in transforms.conf?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...