Courtesy of this post, I renamed "Microsoft-Windows-DNS-Server" to "Microsoft-Windows-DNSServer" and now I am seeing DNS events in my Splunk server. "Microsoft-Windows-DNS-Server" is part of log name, while "Microsoft-Windows-DNSServer" (no space) is the provider name in XML event. Go figure. ... View more

I thought "[WinEventLog://DNS Server]" is the same as "[WinEventLog://Microsoft-Windows-DNS-Server/Audit]". But yes I am using explicit log name (path). I also stayed away from [WinEventLog://DNS Server] because of this doc . It says importing log is needed, which is confusing.  Below is the trimmed inputsstatus list output PS C:\Program Files\SplunkUniversalForwarder> bin\splunk.exe btool inputs list --debug | Select-String "dns" C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf [WinEventLog://Microsoft-Windows-DNS-Server/Audit] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = <snip> C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf connection_host = dns C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = <snip> ... View more

Yes the events were showed in event viewer in near real-time.   ... View more

@gcusello  Hi Giuseppe, thanks for the guidance! As you can tell I am a newbie here 😉  Actually I did posted a new question here https://community.splunk.com/t5/Getting-Data-In/How-to-forward-only-Windows-events-XML-to-a-3rd-party-system/td-p/680458. I was struggling and saw your Q/A. I understand filtering at forwarder is not a good idea. In any case I've figured out how exactly to filter things out in Splunk Server so my 3rd party partner would get XmlWinEvtLog messages only. Thanks again! Billy ... View more

Hi @gcusello  I found this post as I am trying to solve the same issue. I followed your suggestion and copied all the monitor  stanzas from system\default\inputs.conf to my inputs file in system\local\inputs.conf; and inserted "disable = 1" to all of them. Then I restarted splunk. However, network capture from my Splunk Server still showing all the log entries being forwarded. Below is my inputs.conf file. Do you know what could be the issue? Thanks, Billy. [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk] disabled = 1 index = _internal [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\watchdog\watchdog.log*] disabled = 1 index = _internal [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\license_usage_summary.log] disabled = 1 index = _telemetry [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunk_instrumentation_cloud.log*] disabled = 1 index = _telemetry sourcetype = splunk_cloud_telemetry [monitor://C:\Program Files\SplunkUniversalForwarder\etc\splunk.version] disabled = 1 _TCP_ROUTING = * index = _internal sourcetype=splunk_version [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\configuration_change.log] disabled = 1 index = _configtracker [WinEventLog://Security] disabled = 0 renderXml = 1 whitelist = 4624, 4634 ... View more