Getting Data In

Why are my Windows Event Logs not being forwarded properly with an intermediate forwarder?

Path Finder

I am using an intermediary server (server 2) to collect forwarded logs from many servers (server 3,4,5,etc) and then I use a Splunk forwarder on there to forward those events to my full splunk instance server (server 1).

However, my events are not being forwarded properly. On server 2 they look like this:

   [ Name]  Microsoft-Windows-Security-Auditing 
   [ Guid]  {*****************} 
   EventID 4769 
   Version 0 
   Level 0 
   Task 14337 
   Opcode 0 
   Keywords 0x6020000000000000 
  - TimeCreated
   [ SystemTime]  2015-02-23T14:17:22.10657400Z 
   EventRecordID 705673 
  - Execution
   [ ProcessID]  568 
   [ ThreadID]  5524 
   Channel Security 
   Computer ****************

  TargetUserName *********
  TargetDomainName ************
  ServiceName *********
  ServiceSid *********
  TicketOptions 0x40810345
  TicketEncryptionType 0x13
  IpAddress ***********
  IpPort ******** 
  Status 0x0 
  LogonGuid {************} 
  TransmittedServices - 

   [ Culture]  en-US 
   Message [*long message here*]
   Task Kerberos Service Ticket Operations 
   Opcode Info 
   Channel Security 
   Provider Microsoft Windows security auditing. 

   Keyword Audit Success 

But in splunk it just appears as this:

02/23/2015 02:08:40 PM
SourceName=Microsoft Windows security auditing.
Type=Microsoft Windows security auditing.
TaskCategory=Microsoft Windows security auditing.
OpCode=Microsoft Windows security auditing.
Keywords=Microsoft Windows security auditing.
Message=Microsoft Windows security auditing.

What could be happening in between that is affecting my event details?

0 Karma


I have had the setup " a long time ago" .. and it work without this kind of problems at least ... have you done some changes on the windows collector side as how to process or maybe write/ save the events down on disk again ?Xml versus text or something ..

0 Karma

Path Finder

No. Just simply installed the splunk_TA_windows app onto my forwarder and that is what i got through.

0 Karma


aaah yeah, but you need to some configuration on the windows side to have another windows server act as a "event log receiver" . This is were some of the things might get screwed up "already"

0 Karma

Path Finder

It is a linux server that is acting as the receiver though.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...