Splunk Search

Splunk Cloud- not recieving WinEventLog

dkgs
Communicator

Hi,

We are not receiving Windows event logs .Below is the stanza added in input.conf file. But we are not receiving the data. We are using Universal forwarder to forward data to Splunk Cloud. from the servers 

Is it due to any permission issue in the servers? The same is executed as admin from the servers

Any suggestions would be much appreciated

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = index_base-heilite
renderXml=false

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dkgs,

some quick questions:

  1. are you sending logs directly or passing through an Heavy Forwarder (as recommended by Splunk)?
  2. did you configured outputs.con (or splunk add forward-server <host>:<port> -auth <username>:<password>) (for more infos see at https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/Forwarding/Configureforwarderswithoutputs...)?
  3. are you receiving Splunk Internal Logs?
  4. how do you ingest logs: using Splunk_TA_Windows or modifying an inputs.conf?

About the first question, it's important because you have to enable receiving on Heavy Forwarder.

About the second it's important to know if you correctly configured the destination of log send.

The third assures that the connection is OK and you have to debug only inputs.conf.

The fourt assures that you're watching the correct inputs.conf and you have to enable the wanted windows logs.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...