Why is my search returning no events after data entry?

[jip31]

Hello

I have done a data entry in Splunk for the log event below :

[WinEventLog://Microsoft-Windows-PowerCfg/Diagnostic]
checkpointInterval = 5
current_only = 0
disabled = 0
index = windows
start_from = oldest

But when I'm doing a search on this sourcetype, i have no events
I think its because these event logs don't exist in the event viewer?
if its the case is anybody knows how to create it?
thanks

[woodcock]

If there are no events in the Windows Event Viewer on that server, then you are correct: there is nothing to be sent to Splunk so you will not have any events to search.

[inventsekar]

from this host, do you have other logfiles being sent to Splunk?!?! are they reaching splunk indexer properly?!?!
after added the inputs.conf on that windows system, did you do splunk service restart?!?!

[jip31]

yes for all your questions....

[adonio]

try to put index=windows or index=* before your search

[jip31]

I done it but no events....

[adonio]

ok. please start here:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Troubleshooting/Cantfinddata
read all the way through.