Splunk Search

Failed to find Windows Event Log

g_paternicola
Path Finder

Hello

I'm trying to injest event from this Microsoft event viewer:

[WinEventLog://Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational]
disabled = 0
renderXml = 1
sourcetype = XmlWinEventLog
index = ad

 

My issue is, that the name of  the event log the whole path is and not just "Operational" like the others.

g_paternicola_0-1638539638450.png

 

Because of that I will get an error in Splunk:

ERROR ExecProcessor [5076 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational'

 

Is there a way to escape the "/" before Operational?

Thank you very much in advice.

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Yes, your stanza name is too long. Loose the first part.

You can verify it with powershell

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view...

Check with what -LogName value you'll get results. It's way easier than blindly (re)configuring splunk inputs/

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You need this value as channel name

Screenshot_20211220-091242_Client.jpg

0 Karma

g_paternicola
Path Finder

I already have this in my stanza:

 

[WinEventLog://Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational]
disabled = 0
renderXml = 1
sourcetype = XmlWinEventLog
index = ad
whitelist3=1024

But I always going to get this error, even if I put the '\' escape before "Operational" or after

12-20-2021 09:08:21.416 +0100 ERROR ExecProcessor [21652 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational'

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Yes, your stanza name is too long. Loose the first part.

You can verify it with powershell

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view...

Check with what -LogName value you'll get results. It's way easier than blindly (re)configuring splunk inputs/

0 Karma

g_paternicola
Path Finder

this command was my solution:

Get-WinEvent -FilterHashTable @{ LogName = "Microsoft-Windows-TerminalServices-RDPClient/Operational"; ID = 1024 }

There is no "TerminalServices-ClientActiveXCore" in the PowerShell results. This also why Splunk told me all the time "failed to find ...." Thank you!

0 Karma

g_paternicola
Path Finder

Is there anyone else that can help me, please?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The escape character is '\'.

---
If this reply helps you, Karma would be appreciated.
0 Karma

g_paternicola
Path Finder

Already tried, but it didn't work.. 😞

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...