Getting Data In

UF on Server 2012 R2 Not Pulling in WinEventLog Application

jodros
Builder

This is the first time I have tried running a UF on a server 2012 R2 box. Configuration is the same as my other win boxes. Config being pushed out with deployment server. However no wineventlogs are being sent. UF is 6.1.2. Config from deployment server:

[WinEventLog:Application]
checkpointInterval = 5
current_only = 0
disabled = false
index = app
start_from = oldest

Is this a bug?

0 Karma
1 Solution

jodros
Builder

There was an existing props.conf entry on the indexers to drop wineventlog:application logs by default. Removed and it is working with original syntax. Sorry for the unneeded rabbit trail. Thanks for your time.

View solution in original post

0 Karma

jodros
Builder

There was an existing props.conf entry on the indexers to drop wineventlog:application logs by default. Removed and it is working with original syntax. Sorry for the unneeded rabbit trail. Thanks for your time.

0 Karma

linu1988
Champion

Hello,
I think it is because of your syntax. Could you try the below?

[WinEventLog://Application]
disabled = 0
checkpointInterval = 5
current_only = 0
index = app

Thanks,
L

0 Karma

jodros
Builder

That was my first thought. However after reviewing I believe it is correct. My ds is linux. Verified that the config on the UF is [WinEventLog://Application]. I believe it gets translated. Also, that config on the ds is working on all other winOS boxes.

0 Karma

linu1988
Champion

Do you see any error? Is all the permissions given for reading the logs? Could you check if system/security logs work?

0 Karma

jodros
Builder

Added Security logs to be monitored. That works, however application logs are not working. I added security log monitoring by using this configuration on the ds:

[WinEventLog:Security]

Which translated to

[WinEventLog://Security]

On the winOS box. I don't know why application logs do not get indexed but security logs do? There are no errors that I can see specific to this issue.

Thanks

0 Karma

jodros
Builder

I also just upgraded the UF from 6.1.2 to 6.1.3. Issues still persists. I might try to install an older version of UF, possibly 5.x.

0 Karma

linu1988
Champion

they won't support 2012 as per the versions. Newer version should work. Fire a support case. I will try on one of my VM tomorrow to see if it works

0 Karma

jodros
Builder

The "5." by index is not in my config.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...