cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
mawni
Engager
Member since: ‎09-28-2022
‎11-27-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 2
Member Since ‎09-28-2022
View All

Re: Why the ErrorCode 5 when trying to forward Sys...

by in Installation
‎11-27-2023 03:00 AM
2 Karma
‎11-27-2023 03:00 AM
2 Karma
Hi   It was due to the user being configured to run the Splunk forwarder Windows service. It was a local user account without the necessary rights. I changed it to a local system account and the events started to flow in.   Thanks, Awni ... View more

How to ingest exported sysmon logs to Splunk?

by in Splunk Enterprise
‎11-13-2022 02:08 AM
‎11-13-2022 02:08 AM
Hello Guys I'm trying to ingest exported sysmon logs file to Splunk. I got the file from Splunk attack_data repository. I have already installed Microsoft sysmon add-ons. Splunk attack_data's link:    Every time when I choose xmlWinEventLog:Microsoft-Windows-Sysmon/Operational as a source type, it gives me error Not found.  appreciate your support, how can I ingest exported sysmon logs to splunk?   Thanks, Awni ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎11-27-2023 07:07 AM
Karma from
View All