Getting Data In

Why are Windows events logs no longer being forwarded after universal-forwarder upgrade to 6.1.2 for Windows 2008 R2?

ebailey
Communicator

We just upgraded a very old UF on Windows 2008 R2 to 6.1.2 None of the Windows event logs are being forwarded to the indexer though the UF logs and and custom application logs are being forwarded to the indexer so I know the UF can forward data.

The inputs.conf for the Windows Event logs

[default]

[WinEventLog:Application]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = test

[WinEventLog:Security]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
blacklist = 5156|4656|33205|5158
index = test

[WinEventLog:System]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = test

We have a lot of other UF installs that are using this inputs.conf so I am confused why this it not working.

The only related message I am seeing is:

INFO ModularInputs - No stanzas found for scheme "WinEventLog" in inputs.conf at script (re)start.

Any ideas why the inputs.conf is being ignored?

Thanks

0 Karma
1 Solution

ebailey
Communicator

figured it out - forgot //

[default]

[WinEventLog://Application]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = tu_windows

[WinEventLog://Security]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
blacklist = 5156|4656|33205|5158
index = tu_windows

[WinEventLog://System]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = tu_windows

View solution in original post

jacbob
Splunk Employee
Splunk Employee

I had a similar issue however the solution was different because I had the correct syntax (I had the forward slashes). 

I took the Windows TA and decided that for the WinNetMon stanza I only wanted it to go to specific windows servers as opposed to all of them in my environment. And instead of deleting the stanzas from the Splunk_TA_Windows/local/inputs.conf , I set disabled = 1. So when I created another app specific for the WinNetMon stanza and set that disabled = 0. The disabled = 1 took precedence over my custom app, hence Splunk could not find a WinNetMon stanza. 

Deleting the WinNetMon stanzas from Splunk_TA_Windows/local/inputs.conf fixed my issue.

0 Karma

ebailey
Communicator

figured it out - forgot //

[default]

[WinEventLog://Application]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = tu_windows

[WinEventLog://Security]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
blacklist = 5156|4656|33205|5158
index = tu_windows

[WinEventLog://System]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = tu_windows

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...