Getting Data In

forward from windows machine problem

fisk12
Path Finder

I have installed a universial forwarder on a windows machine and having it send to my splunk machine.
The problem is that on the windows app that i have installed on the splunk server. I cant see any events, in the search app i see it like this for exampel. Running 4.2 on the server.
WinEventLog:System

WinEventLog:Setup

WinEventLog:Security

WinEventLog:Application
Perfmon:Network Interface

Perfmon:Free Disk Space
Perfmon:CPU Load

Perfmon:Available Memory

ActiveDirectory

Tags (1)
0 Karma

ldgrube
Engager

I commented on another thread as well:

I'm seeing the same issue. I believe it is because if you look at the default config files in both the App and the Windows TA add-ons, the indexes are NOT the same. The Win Infra App looks for windows event logs in an index named "winevents" while the TA-Add-On saves event logs to index "wineventlog". I'm not sure how the Infra App config file could possibly work since it doesn't even look in the same locations". I'm working on trying to fix all of those mis-matches myself. Looking at the default eventtypes in the Infra App and the TA-Add-On, they're not the same either.......ugh.

0 Karma

ldgrube
Engager

I commented on another thread as well:

I'm seeing the same issue. I believe it is because if you look at the default config files in both the App and the Windows TA add-ons, the indexes are NOT the same. The Win Infra App looks for windows event logs in an index named "winevents" while the TA-Add-On saves event logs to index "wineventlog". I'm not sure how the Infra App config file could possibly work since it doesn't even look in the same locations". I'm working on trying to fix all of those mis-matches myself.

0 Karma

fisk12
Path Finder

Anyone? Sounds like quite an easy problem to solve.

0 Karma

fisk12
Path Finder

I may have been à bit unclear. The events are being forwarded. They just dont show up in the windows app.

0 Karma

treinke
Builder

I have a few questions:

  1. Is only this one machine forwarding events having the issue (can other machine forward events without problems)?
  2. Is the server setup to receive Splunk forwarded traffic?
  3. Is the forwarder sending to the same port the server is looking for (see question 3)?
  4. From the forwarder, can you telnet to the server over the listening port (telnet servername 8089)?
There are no answer without questions
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...