Getting Data In

WinEventLog:Security from all hosts

lain179
Communicator

I have a silly question. I found this from docs.splunk.com but how do I configure it so that Splunk can get event logs from all hosts? Right now it's just grabbing security events from the forwarder but not any other servers.

[WinEventLog:Security]
disabled = 0
start_from = newest
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 1
checkpointInterval = 5

1 Solution

Ayn
Legend

In order to read logs from other hosts you would either have to a) install forwarders on them too, or b) setup WMI polling of logs from your Splunk instance towards the hosts you're interested in retrieving logs from. For the second case, see more info here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

View solution in original post

cdo_splunk
Splunk Employee
Splunk Employee

Please review this link for forwarding window events log to another host

http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

Ayn
Legend

In order to read logs from other hosts you would either have to a) install forwarders on them too, or b) setup WMI polling of logs from your Splunk instance towards the hosts you're interested in retrieving logs from. For the second case, see more info here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

lain179
Communicator

Never Mind. I had it set up right. I was just typing the wrong name in sourcetype query.

0 Karma

lain179
Communicator

I am already able to monitor disk and CPU usage and what not. That means I have already established the WMI connection, correct? I have already visited that page, and it confused me more.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...