Why am I not seeing any events in Splunk after creating a WinEventLog stanza in inputs.conf?

[joshk2005]

We have an application that imports its events into the Windows Event Log, and I am trying to forward those into Splunk. I've created the inputs.conf for the log [WinEventLog://RightFax]. The events are not showing up in Splunk. What more do I have to configure to start seeing these specific events?

[javiergn · Accepted solution]

Your inputs.conf could be something like this:

[WinEventLog://RightFax]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype=WinEventLog:RightFax
index = your index name or blank if default

Keep in mind that this configuration assumes RightFax logs are right below the root of your event logs (same level as Application, Security or System). If that's not the case you need to specify the full path, for instance: "WinEventLog://Microsoft-Windows-TaskScheduler/Operational"

[joshk2005]

That is perfect and did the job exactly as I would expect. Thank you!