Reporting

What .conf files do I change (path?) to add new windows event codes to like 4726 and so on?

SamHTexas
Builder

What .conf files do I change (path?) to add new windows event codes to like 4726 and so on? What Splunk sever is this done on?

Tags (1)
0 Karma

tscroggins
Influencer

@SamHTexas 

Event log filters are defined in inputs.conf and copied to any instance of Splunk running on Windows, typically in %ProgramFiles%\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local when Splunk Add-on for Microsoft Windows is used. See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Event_Log_filtering.

0 Karma

SamHTexas
Builder

Thank u. Which Splunk server do this on please?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...