Thank you very much , by adding this lines i can break this envents . ... View more

Hello ; Thank you for your response , I add this lines without any result . You will find below the error message : Invalid key in stanza [WinEventLogs: Kaspersky Event Logs] in C: \Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 6: st art_from (value: oldest) Do you please have any idea on how to solve this issue ... View more

Thank you for your response you find below the responses of your questions: local user or domain user? local user Does the service start fine when you manually try it after a reboot? yes This problem come only if i add the instructyions in inputs.conf of kaspersky ? when I delete these lines splunk universal forwarder continue work fine ! My be I do a mistak in the inputs .conf for kaspersky [WinEventLog://Kaspersky Event Log] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 index = kaspersky renderXml = false Please correct these lines if there is a mistake or tell me how can I monitor the logs of kaspersky?? The only way to index Kaspersky logs is by adding these lines in inputs.conf?? Thank you ! ... View more