Events from 2008 r2 fileshare to splunk

[Jamesfirth]

hi All, i have a 2008 r2 server that is a file share, i have setup a universal forwarder to send logs to splunk.

Thats working correctly, but there are some events i can see in eventviewer that arent searchable in splunk via event code.

im sure ive missed something simple but can someone point out my mistake please,

[p_gurav]

Can you tell me which event code are not visible in splunk?

[mayurr98]

You are monitoring that particular file for the first time or you had indexed it before?
Or is it something that you are viewing events on splunk web UI and you are not able to filter events ?

[Jamesfirth]

this is the first time we have monitored this server - sending event viewer logs, but a lot of the security EventCodes dont come up, and they are the ones i need to see which user moved or accessed a file

i can see the eventcodes in eventviewer but searching via splunk - these particular eventcodes dont show up but others do

[mayurr98]

are you able to see those events in the file you are monitoring and not at the front end event viewer?