Getting Data In

i can't seeing Windows Event 1102

dariobuonocore9
New Member

In my Splunk Enterprise instance, i can't seeing the windows event "1102" from W10 client.

Someone can me help ?

0 Karma

mledford
Explorer

Have you verified that the event is being generated on the W10 client?

0 Karma

Anonymous
Not applicable

Is the Windows 10 in a domain?

Event 1102 is logged whenever the Security log is cleared,
REGARDLESS of the status of the Audit System Events audit policy.
Source: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1102

0 Karma
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...