Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs?

[ceichhorn]

I'm running Splunk Enterprise on a Windows 2008 R2 server and I'm looking to index the local security logs for the server in to splunk. I can't seem to figure out how to do this: can someone help me with that? I'm sure it's rather simple, I just can't find it. Thanks!

[menonmanish · Accepted solution]

For Splunk 5, simply use the following in your inputs.conf
[WinEventLog:Security]
disabled = 0

For Splunk Latest release use
[WinEventLog://Security]
disabled = 0

Refer to http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/MonitorWindowsdata for more details.

[ceichhorn]

Thanks very much Meno, this got it.