WinEventLog - Appliction and Services Logs- Does anyone have a doc or suggestion?

[ttiller]

Trying to collect information from a sub folder in a Windows server event log. Specifically in the Applications and Services Logs/DFS Replication folder. So far it looks like I need to add some info to my local conf file, but unsure of the proper syntax. I believe it would be along these lines:

[WinEventLog:"Application and Services Logs/DFSReplication"]
disabled=0
start from=oldest
currentonly=0

Can anyone point me to the proper doc to figure this out or offer a suggestion. Thanks in advance.

[wcolgate_splunk]

The syntax for Windows event log stanza is:

[WinEventLog://<channel-name>]

[richgalloway]

Have you tried removing the quotation marks from the stanza name?

[ttiller]

The adjustment was  made on the backend so now my search should be successful. Thank you for your suggestion.

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[ttiller]

I have not. I was unsure if I was even on the right track and did not want to jump off the cliff without some assurances that I'm not going to screw something up. "Nothing ventured nothing gained" as they say. Will give it a go and let you know. Thanks