Getting Data In

Splunk Add-on for windows

Roy_9
Motivator

Hello,

Does the below log paths of windows logs can be ingested into Splunk and if this is available in any add-on's?

Microsoft\Windows\Privacy-Auditing\Operational EventLog


Thanks

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Any eventlog you can see in the Event Viewer can be ingested into Splunk. It's just that you have to address it properly. The easiest way to find the proper name is to go to Event Viewer, find your eventlog, click RMB, select properties and see the Full Name field. In case of your log it's:

PickleRick_0-1717090201434.png

So you need to define a proper inputs.conf stanza for this log:

[WinEventLog://Microsoft-Windows-Privacy-Auditing/Operational]
index=<your_destination_index>
disabled=0

 

gcusello
SplunkTrust
SplunkTrust

Hi @Roy_9 ,

what is this kind of logs?

is there an add-on for these logs?

if they are text files, you can ingest in Splunk, but I never saw them, so you have to create your parsing rules.

Ciao.

Giuseppe

0 Karma

Roy_9
Motivator

Hi @gcusello 

there are logs for the windows onesettings service "This service offers to report telemetry data back to MS about OS health, build info, etc. in order to keep the computer "healthy" . We came accross this setting recently. The logs are written to "Microsoft\Windows\Privacy-Auditing\" and they are in Windows Event Log

I am not sure whether these events can be tracked using Splunk add-on for windows, any thoughts on this?


Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Roy_9 ,

you can create a custom input and you have to find the parsing rules.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...