Universal Forwarder - wineventlog

[jwilliams]

Using the Splunk Universal Forwarder for windows.  Does the forwarder identify the data as wineventlog?  How is that set?

[venkatasri · Accepted solution]

Hi @jwilliams 

UF ships with Windows add-on which does the collection of winevent logs if the inputs are enabled while installation or can be done later as well.

A detailed post already exist here - https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-collect-basic-Windows-OS-Event-Log-dat...

Splunk docs here - https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/SourcetypesandCIMdatamodelinfo

---

an upvote would be appreciated if this reply helps!