Getting Data In

Splunk server running on Win2008 R2 Server not showing R2 Logs

wy1z
Explorer

My setup involved 4 VMs - RHEL 5.6, Windows 7 Enterprise, Windows Server 2008 R2, and Windows XP w/SP3.

Splunk server is installed on the Win 2008 box, and the SUF is installed on the other systems.

The issue I have is the 2008 server logs are NOT showing up in Splunk (which is where Splunk is installed to begin with).

Any help would be most appreciated.

Scott

Tags (2)
0 Karma

tgow
Splunk Employee
Splunk Employee

What user are you running Splunk as?

Have you selected the Event Logs that you want to monitor?

Manager-->Data Inputs-->Local event log collection

Make sure that the desired event log channels are selected in Splunk Web or properly configured in inputs.conf.

Make sure to select fewer than 64 event log channels per event log input.

Make sure that you are not attempting to index exported event logs that are incompatible with the indexing system (for example, attempting to index event logs exported from a Windows Server 2008 computer on a Windows XP computer will result in missing log data).

Make sure that, if you are monitoring non-standard event log channels, that you have the appropriate dynamic linked libraries (DLLs) that are associated with that event log channel. This is particularly important when indexing exported log files from a different computer.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...