Getting Data In
Highlighted

Why am I not seeing any events in Splunk after creating a WinEventLog stanza in inputs.conf?

Explorer

We have an application that imports its events into the Windows Event Log, and I am trying to forward those into Splunk. I've created the inputs.conf for the log [WinEventLog://RightFax]. The events are not showing up in Splunk. What more do I have to configure to start seeing these specific events?

0 Karma
Highlighted

Re: Why am I not seeing any events in Splunk after creating a WinEventLog stanza in inputs.conf?

SplunkTrust
SplunkTrust

Your inputs.conf could be something like this:

[WinEventLog://RightFax]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype=WinEventLog:RightFax
index = your index name or blank if default

Keep in mind that this configuration assumes RightFax logs are right below the root of your event logs (same level as Application, Security or System). If that's not the case you need to specify the full path, for instance: "WinEventLog://Microsoft-Windows-TaskScheduler/Operational"

View solution in original post

Highlighted

Re: Why am I not seeing any events in Splunk after creating a WinEventLog stanza in inputs.conf?

Explorer

That is perfect and did the job exactly as I would expect. Thank you!

0 Karma