Some logging are in the _internal index instead of wineventlog

[OsmanElyas]

I have configured 5 domain controllers to send log to Splunk by installing UF.

I have DC2 and DC5 reporting to Winevenlog as it is configured but I am missing the other 3 DCs.

All logging to _internal what should I do to correct the logging.

[OsmanElyas · Accepted solution]

I have stopped and restarted the services (Splunk forwarders) on DCs and it fix the issue

[OsmanElyas]

I have checked internal events only logging for 5 of them are in the _internal 

I have  windows eventlog for Dc2 and 5 on the Wineventlog

I will check aging the UF to see where is the problem

Much appreciate your help @PickleRick 

[PickleRick]

What do you mean by "logging to _internal"? Normally in _internal index you'll find... well, internal events coming from the forwarder itself - metrics, forwarder errors and such. And you should have them from all 5 forwarders.

But if you see your windows eventlogs contents in _internal - that's a big misconfiguration. Either someone put index=_internal into inputs.conf defining your windows eventlog inputs (but why would someone do that???) or you have some strange redirecting mechanics defined in your environment by which the events end up in that index. But it's higly unlikely.

There is also a third option - your _internal index is set as a lastChanceIndex (which is a wrong setting - this one should point to a normal - non-_internal - index) and your inputs are misconfigured and try to write to a non-existent index.