Getting Data In

Universal Forwarder Not sending my windows events log

New Member

Well! i have configured my suplunk server to accept logs on 9997 from remote. And i have configure my universal forwarder to forward logs to my splunk server to 9997 port.
My output.conf file is as:
defaultGroup = default-autolb-group

server =


and my input.conf is as:

host = splunk1-PC

disabled = 0

disable = false

disable = false

disable = false

By doing netstat -n to my splunk server and windows system [universal forwarder] is can see this vice versa

Local Address Foreign Address State ESTABLISHED

apache logs are coming from the windows system[universal forwarder] but windows events are not. I am unable to find the exact problem. Kindly help!!

0 Karma


Your disabled configuration lines appear to have a typo. They should be disabled = 0 (or false), not disable.

You can verify your configuration by running splunk btool inputs list --debug and looking for the ones you attempted to enable to see if they still show disabled = 1 (or true).

0 Karma

Ultra Champion

A cheerful place to start at I can't find my data!

0 Karma