Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nmenon1215
nmenon1215
New Member
Member since:
08-20-2024
08-30-2024
Community Statistics
| Posts | 3 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 08-20-2024 |
Activity Feed
- Posted Re: Universal Forwarder not sending Directory Service and other logs. on Getting Data In. 08-22-2024 06:40 PM
- Posted Re: Universal Forwarder not sending Directory Service and other logs. on Getting Data In. 08-21-2024 09:50 AM
- Posted Universal Forwarder not sending Directory Service and other logs. on Getting Data In. 08-20-2024 03:29 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
08-22-2024
06:40 PM
Truncated Output(The message was too long): C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf [SSL] C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf _rcvbuf = 1572864 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf allowSslRenegotiation = true C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf certLogMaxCacheEntries = 10000 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf certLogRepeatFrequency = 1d C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf ecdhCurves = prime256v1, secp384r1, secp521r1 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf host = <Full Computer Name> C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf index = default C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf logCertificateData = true C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf sslQuietShutdown = false C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf sslVersions = tls1.2 C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf [WinEventLog://Application] C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf checkpointInterval = 5 C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf current_only = 0 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf disabled = 0 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 host = <Full Computer Name> index = default C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf interval = 60 C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf start_from = oldest C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf [WinEventLog://DNS Server] C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf checkpointInterval = 5 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf current_only = 0 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf disabled = 0 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 host = <Full Computer Name> C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf index = main C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf interval = 60 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf start_from = oldest C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf [WinEventLog://Directory Service] C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf checkpointInterval = 5 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf current_only = 0 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf disabled = 0 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 host = <Full Computer Name> C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf index = main C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf interval = 60 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf start_from = oldest C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf [WinEventLog://ForwardedEvents] C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf checkpointInterval = 5 C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf current_only = 0 C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf disabled = 0 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 host = <Full Computer Name> index = default C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf interval = 60 C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf start_from = oldest C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf [WinEventLog://Security] C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf checkpointInterval = 5 C:..\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf current_only = 0 C:..\SplunkUniversalForwarder\etc\system\local\inputs.conf disabled = 0 C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:..\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 host = <Full Computer Name> index = default
... View more
08-21-2024
09:50 AM
Made the changes but still didn't see the logs go through. I am setting up the inputs.conf file on the Windows VM locally and then restarting the Splunk Forwarding Service afterwards to see the changes. Here are the settings and path:
C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf
host = <Full Computer Name>
[WinEventLog://Application]
disabled = 0
[WinEventLog://Security]
disabled = 0
[WinEventLog://System]
disabled = 0
[WinEventLog://Directory Service]
disabled = 0
checkpointInterval = 5
current_only = 0
disabled = 0
index = main
start_from = oldest
[WinEventLog://DNS Server]
disabled = 0
checkpointInterval = 5
current_only = 0
disabled = 0
index = main
start_from = oldest
[perfmon://Network Interface]
disabled = 1
[perfmon://CPU Load]
disabled = 1
[perfmon://Available Memory]
disabled = 1
[perfmon://Disk Space]
disabled = 1
Another problem I am noticing is that even though I disabled the perfmon logs, they still show. Not a big deal but it might help diagnose the root problem.
... View more
08-20-2024
03:29 PM
I have uploaded a Universal Forwarder to my Windows VM and configured both the inputs.conf and outputs.conf. I can confirm that the outputs.conf is working because the following logs are showing up in splunk:
[WinEventLog://Application]
disabled = 0
[WinEventLog://Security]
disabled = 0
[WinEventLog://System]
disabled = 0
However, logs under Applications and Services Logs are not showing up:
[WinEventLog://Directory Service]
disabled = 0
[WinEventLog://DNS Server]
disabled = 0
I have checked the Event Viewer to confirm that there are logs. The only difference that I see is that in the Event Viewer, the logs that are showing are in the path: Event Viewer (Local) -> Windows Logs -> and the ones that are not showing are in the path: Event Viewer (Local) -> Applications and Services Logs -> my inputs.conf file:
host = <full computer name>
[WinEventLog://Application]
disabled = 0
[WinEventLog://Security]
disabled = 0
[WinEventLog://System]
disabled = 0
[WinEventLog://Directory Service]
disabled = 0
[WinEventLog://DNS Server]
disabled = 0
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-30-2024
08:43 PM
|
