Installation
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- software uninstalled
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
riqbal47010
Path Finder
09-29-2019
11:58 PM
Dear All,
how can I know that if someone uninstall anti virus solution on windows server or client. can we get that logs with windows TA ?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jacobpevans
Motivator
09-30-2019
07:40 AM
Greetings @riqbal47010,
Yes, this is possible with the Windows TA. See documentation below. Of particular interest to you is WinEventLog in the third link. You can also check out the inputs.conf in the default directory after installing the add-on (note that all inputs are disabled by default - you can copy stanzas into a new inputs.conf in the local directory in order to enable Event Log monitoring). 11724 is the Windows Application Event Code that documents uninstallations.
https://splunkbase.splunk.com/app/742/#/details
https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows
https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration
Cheers,
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jacobpevans
Motivator
09-30-2019
07:40 AM
Greetings @riqbal47010,
Yes, this is possible with the Windows TA. See documentation below. Of particular interest to you is WinEventLog in the third link. You can also check out the inputs.conf in the default directory after installing the add-on (note that all inputs are disabled by default - you can copy stanzas into a new inputs.conf in the local directory in order to enable Event Log monitoring). 11724 is the Windows Application Event Code that documents uninstallations.
https://splunkbase.splunk.com/app/742/#/details
https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows
https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration
Cheers,
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Get Updates on the Splunk Community!
See your relevant APM services, dashboards, and alerts in one place with the updated ...
As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...
Index This | What goes away as soon as you talk about it?
May 2025 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this month’s ...
What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025
This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...
