Hi
I have a Windows Server Collecting WinEventLogs from a number windows host endpoints.
I was told the Server was a WEC, Windows Event Collector, unfortunately I don't have access to it.
The UF is install and has the following inputs.conf however I am not receiving the ForwardedEvents.
Is this inputs correct for collecting the Forwarded Events? Any advise T-shooting is appreciated. Thank you!
[WinEventLog://Application]
disabled=0
index = <idx_name>
[WinEventLog://Security]
disabled=0
index = <idx_name>
[WinEventLog://System]
disabled=0
index = <idx_name>
[WinEventLog://ForwardedEvents]
disabled=0
index = <idx_name>
