SMB server logs not coming in into splunk

Getting Data In

Hi All,

We have configures below stanza on SMB server(UF) and splunk forwarder to collect SMB logs,

[WinEventLog://Microsoft-Windows-SMBServer/Audit]
disabled = 0
start_from = oldest
current_only = 0
index = wineventlog

Can you please let us know if the above stanza worked for anyone to collect the logs or share any working stanza is appreciated.

TIA

Sharada

Get Updates on the Splunk Community!

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Join the Conversation