Splunkers,
I want to get in Microsoft-Windows-PowerShell/Operational logs into Splunk. There is no default setting for it in the default/inputs.conf file.
I think this is the answer:
[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled=0
Hello,
Yes, it is the correct input, you should place this input on an inputs.conf file on a /local/ folder, don't forget to set an index and a sourcetype, for example:
[WinEventLog://Microsoft-Windows-PowerShell/Operational]
index=<my_index>
sourcetype=<my_sourcetype>
disabled=false
Hello,
Yes, it is the correct input, you should place this input on an inputs.conf file on a /local/ folder, don't forget to set an index and a sourcetype, for example:
[WinEventLog://Microsoft-Windows-PowerShell/Operational]
index=<my_index>
sourcetype=<my_sourcetype>
disabled=false