Splunk Search

Failed to find Windows Event Log

g_paternicola
Path Finder

Hello

I'm trying to injest event from this Microsoft event viewer:

[WinEventLog://Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational]
disabled = 0
renderXml = 1
sourcetype = XmlWinEventLog
index = ad

 

My issue is, that the name of  the event log the whole path is and not just "Operational" like the others.

g_paternicola_0-1638539638450.png

 

Because of that I will get an error in Splunk:

ERROR ExecProcessor [5076 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational'

 

Is there a way to escape the "/" before Operational?

Thank you very much in advice.

Labels (1)
0 Karma
1 Solution

PickleRick
Ultra Champion

Yes, your stanza name is too long. Loose the first part.

You can verify it with powershell

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view...

Check with what -LogName value you'll get results. It's way easier than blindly (re)configuring splunk inputs/

View solution in original post

0 Karma

PickleRick
Ultra Champion

You need this value as channel name

Screenshot_20211220-091242_Client.jpg

0 Karma

g_paternicola
Path Finder

I already have this in my stanza:

 

[WinEventLog://Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational]
disabled = 0
renderXml = 1
sourcetype = XmlWinEventLog
index = ad
whitelist3=1024

But I always going to get this error, even if I put the '\' escape before "Operational" or after

12-20-2021 09:08:21.416 +0100 ERROR ExecProcessor [21652 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational'

 

0 Karma

PickleRick
Ultra Champion

Yes, your stanza name is too long. Loose the first part.

You can verify it with powershell

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view...

Check with what -LogName value you'll get results. It's way easier than blindly (re)configuring splunk inputs/

0 Karma

g_paternicola
Path Finder

this command was my solution:

Get-WinEvent -FilterHashTable @{ LogName = "Microsoft-Windows-TerminalServices-RDPClient/Operational"; ID = 1024 }

There is no "TerminalServices-ClientActiveXCore" in the PowerShell results. This also why Splunk told me all the time "failed to find ...." Thank you!

0 Karma

g_paternicola
Path Finder

Is there anyone else that can help me, please?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The escape character is '\'.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

g_paternicola
Path Finder

Already tried, but it didn't work.. 😞

 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...