Windows events log monitoring

[RashmiGowda]

I need to monitor the windows event logs using the universal forwarder. Please help me out for the below queries:-

1. How to configure the inputs for remote machine.
2. If i want to monitor only application events logs, how to filter the application event log for a particular application event logs.

Thanks in advance. 🙂

[lukejadamec]

You can configure this when you install the forwarder on the remote machine. There is a setting GUI during the install that allows you to select which event logs to monitor.

Settings for monitoring the event logs can be found in on the forwarder in the splunk\etc\apps*\local\inputs.conf files. Some will be turned on, and others will be turned off. You can turn them on or off by changing the "disabled" parameter value to 1 (off) or 0 (on). If you make changes to inputs.conf you will need to restart the splunkd service on the forwarder for the changes to take affect.