I want to get in Microsoft-Windows-PowerShell/Operational logs into Splunk. There is no default setting for it in the default/inputs.conf file.
I think this is the answer:
Yes, it is the correct input, you should place this input on an inputs.conf file on a /local/ folder, don't forget to set an index and a sourcetype, for example:
View solution in original post