Monitoring Splunk

Unable to monitor logs from windows machine.

ppanchal
Path Finder

Hi,
I am struggling to monitor files from a windows machine.

Below is my inputs.conf file

[default]
index=maspat

[monitor://C:\MASPAT\Results]
sourcetype=mas
crcSalt=
ignoreolderThan=1d

Not sure why I see an unknown log like below getting logged instead of the actual files.

LogName=Application
SourceName=SecurityCenter
EventCode=15
EventType=4
Type=Information
ComputerName=AZP*******.wm.com
TaskCategory=The operation completed successfully.
OpCode=Info
RecordNumber=72097
Keywords=Classic
Message=Updated Symantec Endpoint Protection status successfully to SECURITY_PRODUCT_STATE_SNOOZED.

Tags (1)
0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @ppanchal,

Did @HiroshiSatoh solve your issue? If not, give us some more details to keep the post alive. That way, you have a greater chance of someone helping you solve your problem. Thanks!

0 Karma

HiroshiSatoh
Champion

There are various reasons why logs can not be acquired.
In addition to setting mistakes, search may also be wrong. Please check first according to troubleshooting.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Troubleshoottheinputprocess

By the way, are you using crcSalt correctly?

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...