Hello All, We have a Splunk Universal Forwarder 9.4.0 (then 9.4.3) installed on a Windows 2022 box to which we don't have direct access. We have deployed some apps and the forwarder manages to send us its splunkd.log and some other monitor inputs but we are not able to get the WinEvents (Applications/System/Security) using the specific stanzas.  The host is more hardened that usual,  but the Admins managed to configure what they believe are the EventLog permissions, to no avail. Something like this, never happened to us. We tried updating the agent version and configuring the installation both with LOCAL System permissions and Virtual Account permissions, but still no success. We don't see any relevant internal info regarding some problem with Permissions or EventLog access.  - is there any event we should look for on Windows Logs or UFW logs to undertand this problem? - Is there anything we can activate in the UFW to get more info about this limitation?  Thank you ... View more

Hello, Imagine you have hundreds of Windows Universal Forwarders each sending three sources to your "Heavy Forwarders" then forwarded to the Indexers. Imagine you want to send just one of the sources, source A, of one of those Universal Forwarders, host A, via Syslog to a 3rd Party.   Is there an "elegant way" of filtering just that specific source of that specific host to be sent via syslog on the "Heavy Forwarders"/Indexers? Thank you ... View more