I think your whitelist setting should be correctly formatted; try using whitelist = 4624,4625 to ensure proper filtering and, confirm whether renderXml=false is appropriate, as XML-based logs may require renderXml=true for accurate extraction. Next, check if Windows is generating these events by running this command in PowerShell. Get-WinEvent -LogName Security | Where-Object { $_.Id -eq 4624 -or $_.Id -eq 4625 } | Select-Object -First 10 If no events appear, ensure that Windows auditing policies are correctly configured by navigating to gpedit.msc → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff → Audit Logon, and verifying that success and failure logging is enabled. You can also confirm this by running auditpol /get /subcategory:"Logon" in PowerShell. If you see errors like - It could indicate a misconfiguration in inputs.conf ERROR ExecProcessor - message from "WinEventLog" The parameter is incorrect. And, perform a Splunk search to confirm if any relevant events have been indexed by running : index=* sourcetype=Security:AD_Sec_entmon EventCode=4624 OR EventCode=4625. If no results appear, try searching with index=* EventCode=4624 OR EventCode=4625 OR check index metadata with | metadata type=sourcetypes index=wineventlog. If data is still missing, it’s worth testing with the default Splunk sourcetype by modifying inputs.conf to use sourcetype=WinEventLog:Security instead. [WinEventLog://Security] index = wineventlog sourcetype=WinEventLog:Security disabled = 0 start_from = oldest current_only = 1 evt_resolve_ad_obj = 1 checkpointInterval = 300 whitelist = 4624,4625 After making any configuration changes, restart the Splunk Universal Forwarder using splunk restart or Restart-Service SplunkForwarder on Windows.
... View more
