Getting Data In

How to troubleshoot why Windows event logs are not making into the target index?

davidjohnbecket
Path Finder

We are monitoring for specific Windows events on our Domain Controllers.
Inputs.conf looks like this:

[WinEventLog://Security]
disabled = 0
index = winevents
start_from = oldest
current_only = 0
checkpointInterval = 5
whitelist = 4728,4729,4732,4733,4756,4757,4755

Whe I add a test user to a universal security group, I trigger an event in the security log:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/11/2016 3:22:50 PM
Event ID:      4756
Task Category: Security Group Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      xxxxxxxxxxxx
Description:
A member was added to a security-enabled universal group.

Subject:
    Security ID:        LONDON\xxxxxxxxxxxx
    Account Name:       xxxxxxx
    Account Domain:     LONDON
    Logon ID:       0x86xxxx

Member:
    Security ID:        LONDON\splunk_test
    Account Name:       CN=Splunk Test Log Generator UK,OU=xxx,OU=Test Area,OU=xxx,OU=OIAL,DC=xxx,DC=xxx,DC=xxx

Group:
    Security ID:        LONDON\xxxxxx
    Account Name:       xxxxxxxxxxxx
    Account Domain:     LONDON

Additional Information:
    Privileges:     -

Event Xml:

Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
EventID>**4756**

etc etc

But this event never makes it into the index.
No errors on the splunkd log.
What am i missing?

0 Karma

maciep
Champion

That seems to look right. What version of Splunk? Do you get any events from the dc in Splunk (internal events included)? Any other events from the event log on that dc? Any event log events from any forwarders? Where is your inputs.conf located?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...