@PickleRick , Thanks for replying , When I said crcsalt has something to do with index. My question is here only by using above configs in inputs.conf file, data is not coming to the nominated index in splunk.  I used crcSalt as someone from splunk community mentioned to use it, prior to using crcSalt, even logs were not coming at first place due to file length or file bytes issue (how the splunk UF process the file names) I tried all your mentioned option but it did not work, it is still coming to main index. Splunk documentation is very light on such issues. I ran  splunk btool inputs list monitor --debug I could not see what is the issue or how to identify misconfig while running  splunk btool inputs list monitor --debug Thanks   ... View more

We have resolved DNS logs without using TA_Windows, but still I found it there are some issues with WinEventViewer for ADFS Trace logs. after enabling advanced logging on ADFS but still not getting ADFS Trace logs.   ... View more

@scelikok I did not get it when you said mismatch. Input.Confs is pretty standard provided by Splunk Addons for Windows: Sorry Cannot provide DNS Events, it is also pretty standard DNs events.   Thanks     ... View more

@gcusello , I said in last post, we are not allowing any powershell script can be executed on DNS server so that is the issue here, you believe. Is the DNS server log kicks off PS script as part of collecting logs from Event Viewer. what do you mean by  DNS monitoring is enabled at Windows level . is this related to DNS logging and diagnostics? I can see DNS events in Event Viewer so it means DNS monitoring is enabled on windows level.   Thanks     ... View more

I am wondering if any powershell script run as part of [WinEventLog:// DNS Server] ? if yes, then we have policy to stop Powershell Script remotely, only signed powershell script is allowed. Not sure about this @gcusello  ... View more

Hi @gcusello yes, I have Installed UF on windows  machine where DNS Server role is installed yes, I am receiving other OS logs (WinEventLog:Application, Security) to splunk indexer yes, I enabled DNS logs as per below: #### WinEventLog Inputs for DNS ######## [WinEventLog:// DNS Server] disabled=0 renderXml=false index = microsoft_windwos Still not getting DNS logs, I can see those logs in Event Viewer on windows but not appearing in Splunk indexer Note: I am using Technical Addons called (Splunk_TA_windows) Thanks   ... View more