Getting Data In

Splunk Universal Forwarder - Splunk_TA_windows addon

africates
Explorer

Hi,

Anybody knows how to include the windows server backup logs using Splunk_TA_windows addon? I have tried adding the following configuration to local\inputs.conf but it does not seem to work.

[WinEventLog:Microsoft-Windows-Backup/Operational]
disabled = 0
index = wineventlog
renderXml=false
start_from = oldest
checkpointInterval = 5

Any suggestions please?

Labels (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Can you please try below stanza ?

 

[WinEventLog://Microsoft-Windows-Backup]
disabled = 0
index = wineventlog
renderXml=false
start_from = oldest
checkpointInterval = 5

Update: stanza updated.

 

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Can you please try below stanza ?

 

[WinEventLog://Microsoft-Windows-Backup]
disabled = 0
index = wineventlog
renderXml=false
start_from = oldest
checkpointInterval = 5

Update: stanza updated.

 

View solution in original post

africates
Explorer

Thanks @harsmarvania57 . This seems to work.

 

Thanks a lot!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!