Correct format for inputs.conf stanza

[sswigart]

I want to add C:\windows\system32\winevt\logs\Microsoft-Windows-DriverFrameworks-UserMode/Operational  as a stanza in my inputs.conf.

How do I write the stanza?

Thank you

[marnall · Accepted solution]

Are those logs deliberately put in a file, or can they be viewed in the Windows Event Log?

If they are in the Windows Event Logs, then you can use a WinEventLog stanza:

[WinEventLog://Microsoft-Windows-DriverFrameworks-UserMode/Operational]
index=<your index>
sourcetype=<your sourcetype>
#etc

 ref: https://docs.splunk.com/Documentation/Splunk/9.2.0/admin/Inputsconf

[sswigart]

Thank you!