We are already onboarding Windows Event logs to Splunk, and with that now we also want to onboard windows Key Management Service logs to Splunk. Does anyone know how to onboard this type of log into Splunk?
Assuming, these are under Event Viewer ( For example: Event Viewer > Windows Logs > Applications and Services ) you need to add monitors like below in the local inputs.conf of the Windows host in question.
Example: Below is the way we specify the path of the channel from EventViewer for sending over UAC logs. This is to be defined under