eventtype="wineventlog_common" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="4625" Type="" TaskCategory="登入" I saved above search code as alert , but no alert generated when "4625" event happended ... View more

You can set the maximum event size with the TRUNCATE setting. ... View more

Hi, sry but your question is unreadable. please rephrase your question. ... View more

If you "checked all the boxes" you really should have an inputs.conf containing more than just the two lines - and it's way to much if you just want your Event Logs. Just do a search starting at Splunk's etc directory. Then you should get it. Regarding the domain: I have no idea. You should check if you can reach the indexer from the forwarder with some network tools, e.g. ping or telnet (to port 9997 as said above). I'm not sure about the user and password. If I remember right these are credentials if you are using a proxy server. Update: You seem to use a "Domain Account" for running the Splunk Universal Forwarder. That's what you probably clicked. Just use "Local System" and you are fine. The inputs.conf is under etc\apps\SplunkUniversalForwarder\local\inputs.conf . So that should be fine also in your system. Please check if the file is there and if int contains (e.g.) [WinEventLog://Application] - and the same for Security and System. ... View more

it works, thx ... View more

if you want to stop the monitoring from the source >> On forwarder >> check for the monitoring stanza you have set under "inputs.conf" and disable it by giving disabled = 1 for that particular input alone, so that it will stop monitoring the inputs. ... View more