Splunk Dev

How to set inputs file for collect WinEventLog for File Replication Service

otis_huang
New Member

Dears,

How to set inputs file for collect WinEventLog for File Replication Service?
I try to add two kind of stanza in splunkforwarder file "$SPLUNK_HOME/etc/system/local/inputs.conf" as below:
But It doesn't work. Please help.

stanza:

[WinEventLog:File Replication Service]
disabled=0
sourcetype="WinEventLog:File Replication Service"
index=windows

or

[WinEventLog://File Replication Service]
disabled = 0

Tags (1)
0 Karma
1 Solution

deepashri_123
Motivator
0 Karma

deepashri_123
Motivator

Hi otis_huang,

You can refer this doc below:
https://docs.splunk.com/Documentation/ActiveDirectory/1.2.2/DeployAD/Configureanddeploythetechnicala...

Let me know if this helps!!

0 Karma

otis_huang
New Member

It's AD server (Windows 2012 Enterprise).

0 Karma

p_gurav
Champion

Which windows version you are using?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...