Splunk Lightforwarder for Windows not sending Windows Logs

[balbano]

Based on the previous post for Windows Deployment:

http://answers.splunk.com/questions/434/can-i-auto-install-or-deploy-splunk-onto-all-my-remote-windo...

I was able to use the simple batch script in order to setup my Windows Server to phone home to my Deployment Server.

Once the configs are pushed from the Deployment Server to the Windows Server, Splunk seems to be working fine in Light Forwarder Mode. However, it is only pushing the Splunk Metric and Splunkd logs to my indexers and not the actual windows logs.

The deployment app I am pushing is a custom version of the SplunkLightForwarder App.

Inputs.conf file has the default splunklightforwarder app configs with the following additional stuff:

##############################
#Logs to Monitor
##############################

[WinEventLog:Application]
disabled = false
sourcetype = WinEventLog_App
index = myindex

[WinEventLog:Security]
disabled = false
sourcetype = WinEventLog_Sec
index = myindex

[WinEventLog:System]
disabled = false
sourcetype = WinEventLog_Sys
index = myindex

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
interval = 1
source = wmi
sourcetype = wmi
index = myindex

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 0
interval = 60
source = WinRegistry
sourcetype = WinRegistry
index = myindex

[script://$SPLUNK_HOME\bin\scripts\splunk-admon.path]
interval = 60
source = ActiveDirectory
sourcetype = ActiveDirectory
disabled = 0
index = myindex

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
interval = 60
source = PerformanceMonitor
sourcetype = PerformanceMonitor
disabled = 1
index = myindex

At this point I have only been able to get Windows logs sending to our indexers if I install Splunk Directly on the server and setup the config in $Splunk_Home/etc/system/local. However I have to stop the web service manually and manage configs locally instead of through deployment server.

Can someone chime in here and let me know if I am missing anything or explain why the Windows Logs are not sending?

Any Help is Appreciated.

Thank You.

Brian

[balbano · Accepted solution]

I discovered my issue... it was a config precedence issue. Everything works now.