Why are some Windows Security events not logging in Splunk?

[Jordan54]

I have a UF setup on a windows 2012 server. I am logging Win sec logs but I see some in the event viewer that are not going into splunk.. How can I get all the logs to go into Splunk from the windows server?

[gcusello · Accepted solution]

Hi Jordan54
You have to find in your inputs.conf of Splunk_TA_Windows if there are some blacklist or whitelist.
after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled).
Bye.
Giuseppe