windows events id's gap

[mshakeb]

We have noticed that some Windows Domain Controller server event logs are not appearing in the Splunk search.

For example, we conducted testing on Event ID 4724, and what we noticed is that the event is logged sometimes and sometimes it isn't. what could be the issue? Has anyone faced this before

[gcusello]

Hi @mshakeb ,

I suppose that you're ingesting logs using a Universal Forwarder.

If there isn't any issue /that you can search in _internal) UF read all the wineventlogs from the Domain Controller, so if some event is missed, you should check, if it was generated in WinEventLog.

Ciao.

Giuseppe

[livehybrid]

Hi

Data loss or intermittent event visibility can occur at several points: source generation, forwarder collection/sending, network transport, or indexer processing/filtering.

1. Verify Event Generation: First, confirm the Event ID 4724 is consistently generated in the Windows Security Event Log on the Domain Controller itself using the native Event Viewer during your tests. If it's not logged there reliably, the issue lies with Windows auditing configuration, not Splunk.
2. Check Forwarder Configuration: Ensure the inputs.conf on the Universal Forwarder monitoring the Domain Controller has the correct stanza ([WinEventLog://Security]) and is enabled (disabled = false). Verify no blacklist or whitelist settings within this stanza or related props.conf/transforms.conf are unintentionally filtering Event ID 4724.
3. Check Forwarder Status & Connectivity: Verify the Splunk forwarder service is running on the DC and can connect to the indexers. Check for errors in the forwarder's internal logs.
4. Check Indexer Processing: Ensure no index-time filtering rules (props.conf/transforms.conf on indexers) are discarding these events (e.g., routing to nullQueue).
5. Multiple Domain Controllers: Do you have multiple domain controllers? It could be that one/more of them are not configured correctly to send data to Splunk and therefore when this event is actioned against that particular DC then you do not get the logs in Splunk.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing