Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Universal Forwarder Not Forwarding Windows Event L...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have just installed a Universal forwarder on a windows server and during the installation I selected the option to index windows event logs and performance logs.
I have checked splunk and can see it indexing performance logs, however it is not indexing the windows event logs. I can see these logs set-up in the following location.
C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local\inputs.conf
As it is a windows server, do I need to copy in a windows folder where the inputs.conf file can be updated in window\local folder
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No you shouldn't need to copy anything if the stanza's are properly enabled in the inputs.conf such as:
[WinEventLog:Application]
disabled = false
[WinEventLog:Security]
disabled = false
[WinEventLog:System]
disabled = false
Have you viewed the splunkd.log
Open the %SPLUNK_HOME%\var\log\splunk\splunkd.log file and search for wmi or error .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No you shouldn't need to copy anything if the stanza's are properly enabled in the inputs.conf such as:
[WinEventLog:Application]
disabled = false
[WinEventLog:Security]
disabled = false
[WinEventLog:System]
disabled = false
Have you viewed the splunkd.log
Open the %SPLUNK_HOME%\var\log\splunk\splunkd.log file and search for wmi or error .
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Catalog Is Now Generally Available on Splunk Cloud Platform
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
