WinEventLog question

[santiagn]

hi

i added the below to my inputs.conf and restarted the forwarder service but when i search my host it still does not return any wineventlogs. am i missing something or doing something wrong?

[WinEventLog://Application]
disabled = 0

[WinEventLog://Security]
disabled = 0

[WinEventLog://System]
disabled = 0

[cmerriman]

I have been facing the same issue. Check to make sure your ports are allowed to send data.

go to the Windows Firewall with Advanced Security and check the inbound rules. look for the port your host is on. if it isn't there, add a rule for it, and see if that fixes any issues.

[santiagn]

thanks! but i should've mentioned that i have cpu load and avail memory already working just the wineventlog stanza wasn't.

[gcusello · Accepted solution]

Hi santiagn,
if you want to ingest Windows Event Logs the easiest way is to install on Forwarder Splunk_TA_Windows, enabling only stanzas that you want.

Anyway, in your inputs.conf there isn't any index so try inserting in your search index=main

If there still aren't any logs, verify if your indexer receives logs from the forwarder using this search index=_internal host=your_host
In this way you verify if your forwarder is correctly connected to Indexer.

If not, verify firewalls ans outputs.conf in your forwarder.
If you have _internal logs, verify that forwarder and indexer are time aligned and that Windows on forwarder create logs (verify policies).

Bye.
Giuseppe

[santiagn]

adding index=main made it work.

thanks so much!