See this topic on exactly that issue: http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Addaclustermember ... View more

Take a look at my answer here (the nested one) in case that helps: https://answers.splunk.com/answers/371126/is-it-possible-to-transport-data-from-a-windows-ev.html In summary: [WinEventLog://Path-To-Your-View] disabled = 0 start_from = oldest index = yourindexname For example: [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] Thanks, J ... View more

Hello, someone resolved this issue? Thanks ... View more