Splunk Enterprise

Windows Event Collector Logs only 12 lines long

g_paternicola
Path Finder

Hi everyone, I'm having a strange problem with a Windows event collector. I installed UF on the WEC ( Windows Server Core version) that sends forwarded security events to Splunk. My problem is basically that every single event in Splunk is only 12 lines long, but when I review the event there is a lot more information that should be sent to Splunk for example the description...

I configured the same but with a WEC with GUI and there I get all the lines from the event.

Has anyone ever had the same problem?

Labels (1)
Tags (3)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!