Getting Data In

i can't seeing Windows Event 1102

dariobuonocore9
New Member

In my Splunk Enterprise instance, i can't seeing the windows event "1102" from W10 client.

Someone can me help ?

0 Karma

mledford
Explorer

Have you verified that the event is being generated on the W10 client?

0 Karma

Anonymous
Not applicable

Is the Windows 10 in a domain?

Event 1102 is logged whenever the Security log is cleared,
REGARDLESS of the status of the Audit System Events audit policy.
Source: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1102

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...