Getting Data In

WinEventLog:Security from all hosts

lain179
Communicator

I have a silly question. I found this from docs.splunk.com but how do I configure it so that Splunk can get event logs from all hosts? Right now it's just grabbing security events from the forwarder but not any other servers.

[WinEventLog:Security]
disabled = 0
start_from = newest
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 1
checkpointInterval = 5

1 Solution

Ayn
Legend

In order to read logs from other hosts you would either have to a) install forwarders on them too, or b) setup WMI polling of logs from your Splunk instance towards the hosts you're interested in retrieving logs from. For the second case, see more info here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

View solution in original post

cdo_splunk
Splunk Employee
Splunk Employee

Please review this link for forwarding window events log to another host

http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

Ayn
Legend

In order to read logs from other hosts you would either have to a) install forwarders on them too, or b) setup WMI polling of logs from your Splunk instance towards the hosts you're interested in retrieving logs from. For the second case, see more info here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

lain179
Communicator

Never Mind. I had it set up right. I was just typing the wrong name in sourcetype query.

0 Karma

lain179
Communicator

I am already able to monitor disk and CPU usage and what not. That means I have already established the WMI connection, correct? I have already visited that page, and it confused me more.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...