Getting Data In

Splunk Add-on for windows

Roy_9
Motivator

Hello,

Does the below log paths of windows logs can be ingested into Splunk and if this is available in any add-on's?

Microsoft\Windows\Privacy-Auditing\Operational EventLog


Thanks

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Any eventlog you can see in the Event Viewer can be ingested into Splunk. It's just that you have to address it properly. The easiest way to find the proper name is to go to Event Viewer, find your eventlog, click RMB, select properties and see the Full Name field. In case of your log it's:

PickleRick_0-1717090201434.png

So you need to define a proper inputs.conf stanza for this log:

[WinEventLog://Microsoft-Windows-Privacy-Auditing/Operational]
index=<your_destination_index>
disabled=0

 

gcusello
SplunkTrust
SplunkTrust

Hi @Roy_9 ,

what is this kind of logs?

is there an add-on for these logs?

if they are text files, you can ingest in Splunk, but I never saw them, so you have to create your parsing rules.

Ciao.

Giuseppe

0 Karma

Roy_9
Motivator

Hi @gcusello 

there are logs for the windows onesettings service "This service offers to report telemetry data back to MS about OS health, build info, etc. in order to keep the computer "healthy" . We came accross this setting recently. The logs are written to "Microsoft\Windows\Privacy-Auditing\" and they are in Windows Event Log

I am not sure whether these events can be tracked using Splunk add-on for windows, any thoughts on this?


Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Roy_9 ,

you can create a custom input and you have to find the parsing rules.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...