Universal Forwarder only forwarding select logs

[jkastner]

I am having an odd issue regarding SUF with one of my windows domain workstations that I really could use some help with.  Here are some observations/facts that hopefully someone would be able to help me resolve this.

1. The problem workstation is Windows 11, joined to a domain, and all security settings are controlled by group policy.

2. The problem workstation forwards its Application and System logs fine to the server but wont forward it's Security logs.

3. None of the other workstations have this issue and forward their application, system, and security logs fine.

4. I have reviewed the input.conf file and it is identical to the other workstations.

5. Reviewing the splunk and windows logs reveal no errors that I can see.

6. Reinstalling the forwarder did nothing.

Any help or insights would be greatly appreciated.

[livehybrid]

Hi @jkastner 

What user is the Splunk service running at? If its running as the NT Service\SplunkForwarder user then you may need to add it to"Event Log Readers":

net localgroup "Event Log Readers" "NT SERVICE\SplunkForwarder" /add

For more info check out this other community post: https://community.splunk.com/t5/Getting-Data-In/Splunk-User-of-windows-SplunkForwarder/m-p/675005

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing