Splunk Search

Splunk Cloud- not recieving WinEventLog

dkgs
Communicator

Hi,

We are not receiving Windows event logs .Below is the stanza added in input.conf file. But we are not receiving the data. We are using Universal forwarder to forward data to Splunk Cloud. from the servers 

Is it due to any permission issue in the servers? The same is executed as admin from the servers

Any suggestions would be much appreciated

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = index_base-heilite
renderXml=false

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dkgs,

some quick questions:

  1. are you sending logs directly or passing through an Heavy Forwarder (as recommended by Splunk)?
  2. did you configured outputs.con (or splunk add forward-server <host>:<port> -auth <username>:<password>) (for more infos see at https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/Forwarding/Configureforwarderswithoutputs...)?
  3. are you receiving Splunk Internal Logs?
  4. how do you ingest logs: using Splunk_TA_Windows or modifying an inputs.conf?

About the first question, it's important because you have to enable receiving on Heavy Forwarder.

About the second it's important to know if you correctly configured the destination of log send.

The third assures that the connection is OK and you have to debug only inputs.conf.

The fourt assures that you're watching the correct inputs.conf and you have to enable the wanted windows logs.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...