All Apps and Add-ons

Where does the Windows printer information pull data from?

davidcraven02
Communicator

My colleague has setup a Windows Printer App following the below link http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/MonitorWindowsprinterinformation

However, I am not too sure where the print events are being pulled from as after checking the Event Viewer (Windows > PrintService) some logs are empty or do not contain any printing logs so I am at a loss in understanding where they are pulled from. Does anyone know on a more low level detail how Splunk forwards these events?

Tags (2)
0 Karma

ansif
Motivator

Splunk WinPrintMon input calls an exe file called splunk-winprintmon.exe to get those inputs.Ensure that Print service is enabled in the server to get those data.

splunk-winprintmon.exe (available with UF) collects driver,ports and jobs details. It might not from events viewer.

0 Karma

davidcraven02
Communicator

Thank you for this but how do I check if the service is enabled ?

The actual issue is that when the user prints multiple pages it only shows 1 page being printed on both WinEvent logs as well as in splunk.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...