Other Usage

Some logging are in the _internal index instead of wineventlog

OsmanElyas
Explorer

I have configured 5 domain controllers to send log to Splunk by installing UF.

I have DC2 and DC5 reporting to Winevenlog as it is configured but I am missing the other 3 DCs.

All logging to _internal what should I do to correct the logging.

Labels (1)
Tags (1)
0 Karma
1 Solution

OsmanElyas
Explorer

I have stopped and restarted the services (Splunk forwarders) on DCs and it fix the issue

View solution in original post

0 Karma

OsmanElyas
Explorer

I have stopped and restarted the services (Splunk forwarders) on DCs and it fix the issue

0 Karma

OsmanElyas
Explorer

I have checked internal events only logging for 5 of them are in the _internal 

I have  windows eventlog for Dc2 and 5 on the Wineventlog

I will check aging the UF to see where is the problem

Much appreciate your help @PickleRick 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "logging to _internal"? Normally in _internal index you'll find... well, internal events coming from the forwarder itself - metrics, forwarder errors and such. And you should have them from all 5 forwarders.

But if you see your windows eventlogs contents in _internal - that's a big misconfiguration. Either someone put index=_internal into inputs.conf defining your windows eventlog inputs (but why would someone do that???) or you have some strange redirecting mechanics defined in your environment by which the events end up in that index. But it's higly unlikely.

There is also a third option - your _internal index is set as a lastChanceIndex (which is a wrong setting - this one should point to a normal - non-_internal - index) and your inputs are misconfigured and try to write to a non-existent index.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...