WinEventLog:Security from all hosts

[lain179]

I have a silly question. I found this from docs.splunk.com but how do I configure it so that Splunk can get event logs from all hosts? Right now it's just grabbing security events from the forwarder but not any other servers.

[WinEventLog:Security]
disabled = 0
start_from = newest
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 1
checkpointInterval = 5

[cdo_splunk]

Please review this link for forwarding window events log to another host

http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

[Ayn · Accepted solution]

In order to read logs from other hosts you would either have to a) install forwarders on them too, or b) setup WMI polling of logs from your Splunk instance towards the hosts you're interested in retrieving logs from. For the second case, see more info here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata

[lain179]

Never Mind. I had it set up right. I was just typing the wrong name in sourcetype query.

[lain179]

I am already able to monitor disk and CPU usage and what not. That means I have already established the WMI connection, correct? I have already visited that page, and it confused me more.