Security log is full from Windows is not forwarded to Splunk

[phamanh1652]

Hello All,

We send logs from Windows to Splunk via Universal Forwarder. We want to create alerts for Event ID 1104 - The security log is full and 1105 - Log automatic backup.

However, when searching, we cannot find either of these events.

When reviewing the log files (EVTX), Event ID 1104 appears as the final entry in the archived log, while Event ID 1105 is the initial entry in the newly created EVTX file.

Here is the configuration for log archiving:

[phamanh1652]

For inputs.conf file, we've already enabled the Security log (and others). While other Security Event IDs, like those in the 472x range, are successfully searchable in Splunk, Event IDs 1104 and 1105 are conspicuously absent from search results.

[PrewinThomas]

@phamanh1652 

What's your inputs.conf look like.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[gcusello]

Hi @phamanh1652 ,

I suppose that you're using the Splunk_TA_Windows, did you checked if, in the inputs.log, there's a filter on WinEventLog:Security logs: sometimes not all the EventCodes areindexed.

Ciao.

Giuseppe