Getting Data In

Why are some Windows Security events not logging in Splunk?

Jordan54
New Member

I have a UF setup on a windows 2012 server. I am logging Win sec logs but I see some in the event viewer that are not going into splunk.. How can I get all the logs to go into Splunk from the windows server?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi Jordan54
You have to find in your inputs.conf of Splunk_TA_Windows if there are some blacklist or whitelist.
after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled).
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Jordan54
You have to find in your inputs.conf of Splunk_TA_Windows if there are some blacklist or whitelist.
after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled).
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...