Update: The following directory didn't exist on the indexer so I created it. /opt/splunk/etc/apps/Splunk_TA_windows/local I copied inputs.conf over to the local dir then modified like so: OS Logs [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 1 checkpointInterval = 5 index = wineventlog renderXml=false [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 1 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)" index = wineventlog renderXml=false [WinEventLog://System] disabled = 0 start_from = oldest current_only = 1 checkpointInterval = 5 index = wineventlog renderXml=false Apparently for some reason the default is disabled. But even after enabling and restarting Splunk, no other even sources than WinEventLog:Setup get processed. So either the placement of the inputs.conf file is wrong, or there is some other issuje. Thanks, David ... View more

the threatscore field isn't getting inserted into the data stream... How is this generated? ... View more

Yeah, I get nothing as well. I followed the procedures outlined. Do I need to tweak it for my indexes? Or, do I need to modify "tag=network tag=communicate action=allowed"? Does Python need to be installed separately? If so, which version? How do we go about troubleshooting? I've got other apps installed and working. I'm pulling in syslog data from iptables firewall with logging on all the acls. I'm also pulling in data from Meraki APs and a Synology NAS, Thanks, David ... View more

I've already got Syslog data in NCS Prime and Solarwainds Orion. I'd rather collect data from these aggregate sources. Is this supported somehow? Thanks, David ... View more