Hi,  I know this post is quite old but anyway, here is my stanza which is working fine: [WinEventLog://Microsoft-Windows-BitLocker/BitLocker Management] index = windows disabled = 0 renderXml = 1 evt_resolve_ad_obj= 1 start_from = oldest current_only = 0 checkpointInterval = 5 sourcetype=XmlWinEventLog   Did you check the Splunkd.log on you UF on start? Maybe the user running Splunk Forwarder Service is not able to access the logs. Or there are just no logs available? On my site it is not written very frequently.  The Splunk_TA_windows is also required on the UF.  ... View more