Getting Data In

Why are some Windows Security events not logging in Splunk?

New Member

I have a UF setup on a windows 2012 server. I am logging Win sec logs but I see some in the event viewer that are not going into splunk.. How can I get all the logs to go into Splunk from the windows server?

0 Karma
1 Solution

Legend

Hi Jordan54
You have to find in your inputs.conf of SplunkTAWindows if there are some blacklist or whitelist.
after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled).
Bye.
Giuseppe

View solution in original post

0 Karma

Legend

Hi Jordan54
You have to find in your inputs.conf of SplunkTAWindows if there are some blacklist or whitelist.
after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled).
Bye.
Giuseppe

View solution in original post

0 Karma