Universal forwarder is not collecting events on Forwarded Folder of windows server

[AKG]

Hi All I am new to Splunk and having some issue...

we have a windows 2008r2 server setup as an event collector for windows servers. Event logs from windows server is being forwarded to this server and goes on to "Forwarded Events" folder.

Now I installed universal forwarder on this server with only "Forwarded Events Log" selected. When i go to splunk server, I can't see any events coming.

if I install with other option selected(e.g. Application Log), I can see application log of that server appearing on splunk server.

I was wondering if i am missing something and will appreciate if some one can guide me.

Note:- we have decided not to install splunk agents in every server and not to use wmi as the number of windows we have is lot(in hundreds).

Thank you in Advance.

[kmjackson788]

That fixes it.

%SystemRoot%\System32\Winevt\Logs\ForwardedEvents.evtx

The space [WinEventLog:Forwarded Events] does not work. Hopefully they fixed the documentation. ( I sent a documentation fix)

http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf

I dont have enough credit to upvote the above answer.

[kmjackson788]

They fixed the docs on inputs.conf. @rovechikin Should of submitted a change on the docs inputs.conf page to save people the frustration.

[rovechkin_splun · Accepted solution]

the is a slight bug in default configuration. The issue is that "Forwarded Events" have a space between them, while Windows ForwardedEvents event log doesn't. The workaround is to find all occurrences of "Forwarded Events" in *.conf stanzas and remove space, e.g.

Splunk\etc>find /s "Forwarded Events" *.conf

inputs.conf: [WinEventLog:Forwarded Events]

replace with [WinEventLog:ForwardedEvents]

reboot Splunk.