Getting Data In

Where do I find the logs of a universal forwarder that are installed in a domain controller?

pramach
New Member

Where do I find the logs of a universal forwarder that are installed in a domain controller?

We have universal forwarder installed in domain controller bu the logs for password change attempts are seen in the Domain controller but not in Splunk search head.
Please help to check if the universal forwarder has pushed the logs for password change attempt to the indexer/ heavy forwarder.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@pramach - Did the answer provided by woodcock help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

woodcock
Esteemed Legend

I assume that you are using the TAs, which is great, but there is still admin to do. The most common mistake is that you have not created the index that is used in the inputs.conf. Any index that is used must be created in indexes.conf AND on your filesystem on each of your indexers. Your error logs will be flooded with logs complaining about this, if this is your problem.

0 Karma

somesoni2
Revered Legend

Have you configured your universal forwarders (assuming it's on windows) to monitor (and send ) the event logs ?

0 Karma

pramach
New Member

Yes..We have configures

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...