We have an application that imports its events into the Windows Event Log, and I am trying to forward those into Splunk. I've created the inputs.conf for the log [WinEventLog://RightFax]. The events are not showing up in Splunk. What more do I have to configure to start seeing these specific events?
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = your index name or blank if default
Keep in mind that this configuration assumes RightFax logs are right below the root of your event logs (same level as Application, Security or System). If that's not the case you need to specify the full path, for instance: "WinEventLog://Microsoft-Windows-TaskScheduler/Operational"