Getting Data In

Windows event log collection randomly stops

abonuccelli_spl
Splunk Employee
Splunk Employee

I am collecting WinEventLog (not using WMI) data using a Universal Forwarder, Heavy Forwarder or full Splunk Instance, I'm using versions prior to 5.0.5, and data collection randomly stops; the host I'm collecting data from is surely not idle and generating a fair amount of WinEvents, I am not using WMI. I can see _internal/audit data coming in. A restart fixes the problem, however this happens again at some point.

I have enabled DEBUG and seeing this after the issue happens...

DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.
DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.
DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.
DEBUG WinEventLogInputProcessor - main-thread: Waiting for Windows Event Log with timeout=10000.

Tags (2)
0 Karma
1 Solution

abonuccelli_spl
Splunk Employee
Splunk Employee

There is a bug (SPL-64915 - WinEventLog InputChannel stop collecting data due to constant timeout.)
This is fixed in version 5.0.5 and greater.

View solution in original post

abonuccelli_spl
Splunk Employee
Splunk Employee

There is a bug (SPL-64915 - WinEventLog InputChannel stop collecting data due to constant timeout.)
This is fixed in version 5.0.5 and greater.

Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...