Hi,
This is probably very basic, but I'm not sure where the actual log file sits for Windows Event Logs.
Trying to use a Universal Forwarder on Windows 2008 Server to capture windows event logs. Where would they be on the server?
http://answers.splunk.com/answers/58398/the-universal-forwarder-and-server-2008-event-logs