Splunk monitoring Roxio Secure Burn logs

Getting Data In

Hello, Roxio Secure Burn stores a history of its burn logs to C:\ProgramData\Roxio Log Files

I have a report set up in SPLUNK to monitor that location on all computers that have Roxio installed.

source= "c:\\ProgramData\\Roxio Log Files\\*"

Most of the systems show up fine. However several system have files saved in that location on the local system that do not show in the SPLUNK report.

Those systems are visible for other reports, such as failed logons, reboots, etc. But nothing shows up for the report above. The permissions for that location are the same as systems that DO show up in Roxio.

I have adjusted the time to include the past 6 months, year, and all time. Nothing shows in the SPLUNK results, however I can see logs in the actual directory on the system itself.

Any ideas?

Get Updates on the Splunk Community!

Splunk monitoring Roxio Secure Burn logs

universal forwarder

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

Splunk monitoring Roxio Secure Burn logs

universal forwarder

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience