Getting Data In

Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational

spctravis
Explorer

Splunkers,

I want to get in Microsoft-Windows-PowerShell/Operational logs into Splunk. There is no default setting for it in the default/inputs.conf file.

I think this is the answer:

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled=0

 

Labels (1)
0 Karma
1 Solution

danielcj
Communicator

Hello,

Yes, it is the correct input, you should place this input on an inputs.conf file on a /local/ folder, don't forget to set an index and a sourcetype, for example:

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
index=<my_index>
sourcetype=<my_sourcetype>
disabled=false

View solution in original post

0 Karma

danielcj
Communicator

Hello,

Yes, it is the correct input, you should place this input on an inputs.conf file on a /local/ folder, don't forget to set an index and a sourcetype, for example:

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
index=<my_index>
sourcetype=<my_sourcetype>
disabled=false
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...