I've got Splunk Universal Forwarder up and running on my DC-01, and it's set to forward all Windows event logs to Splunk. But there's a catch - it's not forwarding the Security events for some reason! Interestingly, when I installed the UF on a regular Windows PC, everything worked like a charm, and all event types, including Security events, were forwarded without a hitch. I've done my fair share of digging through documentation and troubleshooting cases, but I'm still at a loss. It feels like it might be a permissions or rights issue, but I can't seem to find the root cause. If any of you have encountered a similar issue or have any insights, I'd be incredibly grateful for your help and ideas. Thank you in advance for any guidance you can provide!
... View more