Unable to monitor logs from windows machine.

[ppanchal]

Hi,
I am struggling to monitor files from a windows machine.

Below is my inputs.conf file

[default]
index=maspat

[monitor://C:\MASPAT\Results]
sourcetype=mas
crcSalt=
ignoreolderThan=1d

Not sure why I see an unknown log like below getting logged instead of the actual files.

LogName=Application
SourceName=SecurityCenter
EventCode=15
EventType=4
Type=Information
ComputerName=AZP*******.wm.com
TaskCategory=The operation completed successfully.
OpCode=Info
RecordNumber=72097
Keywords=Classic
Message=Updated Symantec Endpoint Protection status successfully to SECURITY_PRODUCT_STATE_SNOOZED.

[mstjohn_splunk]

hi @ppanchal,

Did @HiroshiSatoh solve your issue? If not, give us some more details to keep the post alive. That way, you have a greater chance of someone helping you solve your problem. Thanks!

[HiroshiSatoh]

There are various reasons why logs can not be acquired.
In addition to setting mistakes, search may also be wrong. Please check first according to troubleshooting.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Troubleshoottheinputprocess

By the way, are you using crcSalt correctly?