Monitoring Splunk

How do we setup "WinEventLog://HardwareEvents" and "WinEventLog://Setup" in splunk_nix_windows inputs.conf

rangineniarunku
Explorer

Can someone provide me the complete monitoring's stanzas for the "WinEventLog://HardwareEvents" and "WinEventLog://Setup" in inputs.conf for Splunk_TA_windows add-on.

I doubt whether it is same as that we do it for Applications,Security and System?

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

there it is

[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled = 0
index = wineventlog
start_from = oldest

[WinEventLog://HardwareEvents]
checkpointInterval = 5
current_only = 0
disabled = 0
index = wineventlog
start_from = oldest

indeed like all others
hope it helps

View solution in original post

rangineniarunku
Explorer

I tried to deploy the splunk_TA_Windows app from deployment server to the Host with splunk forwarder after the changes in inputs.conf, where I am able to see events indexed from "[WinEventLog://Security]", "[WinEventLog://Application]"and "[WinEventLog://System]" but not from "setup" and "HardwareEvents".

Do we need to make any other changes in Splunk_TA_windows app on Deployment server in order to get the missing logs to be indexed on splunk.

I did not find any script related to"HardwareEvents" or "Setup" at Splunk_TA_windows/samples where as we have for application,security and system

Can anyone help me with this??.

0 Karma

adonio
Ultra Champion

there it is

[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled = 0
index = wineventlog
start_from = oldest

[WinEventLog://HardwareEvents]
checkpointInterval = 5
current_only = 0
disabled = 0
index = wineventlog
start_from = oldest

indeed like all others
hope it helps

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...