WinEventlog Input for [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]

[dkeck]

Hi,

I try to monitor Microsoft-Windows-Shell-Core/AppDefaults directory.

I tried adding it to Splunk_TA_windows by adding an input stanza in inputs.conf

looking like:

[WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=true
index=test_windows

But no data is indexed. I also tried [WinEventLog:Microsoft-Windows-Shell-Core/AppDefaults], makes no difference.

Data is displayed within the event viewer.

Since its a non-default input channel I assume there is no default channel in the Splunk_TA_windows??

Any help is appreciated.

Thank you

David

[gcusello · Accepted solution]

Hi @dkeck,
if you used the configuration you shared, the problem is on disable=1 that means no input!
If you want a log, you have to configure disable=0 in that stanza.
Anyway, the correct approach is:

• take the Splunk TA_Windows,
• put disable=0 in all the stanzas you need,
• deploy the TA to your forwarders,
• restart Splunk on Forwarders.

You can deploy TAs manually or using a Deployment Server.

Ciao.
Giuseppe

[dkeck]

Ok thank you.

I was to stupid, disabled 1 always gets me...

Okay its working with [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]

[gcusello]

No Problem! You're welcomw.
Ciao and next Time.
Giuseppe