@PrewinThomas need to be capturing all event IDs associated with cert services, however for testing purposes was looking specifically for 4876, 4877. And yes the CA server is running universal forwarder. Unsure how to check if Splunk is dropping high-volume events so if you could point me in the right direction for that I will check on that , however looking at the event logs on the CA server would not say these events are particularly high-volume <100 in the past week across all the events for cert services. ... View more

@PickleRick the events are in the Security eventlog which other than the event IDs related to cert services e.g. 4876, 4877, 4885, 4886, 4887, 4888, 4889 can be seen in Splunk. All these event IDs are whitelisted for the WinEventLog security channel in the inputs.conf ... View more