Getting Data In

Why am I not seeing any events in Splunk after creating a WinEventLog stanza in inputs.conf?

joshk2005
Explorer

We have an application that imports its events into the Windows Event Log, and I am trying to forward those into Splunk. I've created the inputs.conf for the log [WinEventLog://RightFax]. The events are not showing up in Splunk. What more do I have to configure to start seeing these specific events?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Your inputs.conf could be something like this:

[WinEventLog://RightFax]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype=WinEventLog:RightFax
index = your index name or blank if default

Keep in mind that this configuration assumes RightFax logs are right below the root of your event logs (same level as Application, Security or System). If that's not the case you need to specify the full path, for instance: "WinEventLog://Microsoft-Windows-TaskScheduler/Operational"

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Your inputs.conf could be something like this:

[WinEventLog://RightFax]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype=WinEventLog:RightFax
index = your index name or blank if default

Keep in mind that this configuration assumes RightFax logs are right below the root of your event logs (same level as Application, Security or System). If that's not the case you need to specify the full path, for instance: "WinEventLog://Microsoft-Windows-TaskScheduler/Operational"

View solution in original post

joshk2005
Explorer

That is perfect and did the job exactly as I would expect. Thank you!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!