Getting Data In

WinEventLog question

santiagn
Path Finder

hi

i added the below to my inputs.conf and restarted the forwarder service but when i search my host it still does not return any wineventlogs. am i missing something or doing something wrong?

[WinEventLog://Application]
disabled = 0

[WinEventLog://Security]
disabled = 0

[WinEventLog://System]
disabled = 0

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi santiagn,
if you want to ingest Windows Event Logs the easiest way is to install on Forwarder Splunk_TA_Windows, enabling only stanzas that you want.

Anyway, in your inputs.conf there isn't any index so try inserting in your search index=main

If there still aren't any logs, verify if your indexer receives logs from the forwarder using this search index=_internal host=your_host
In this way you verify if your forwarder is correctly connected to Indexer.

If not, verify firewalls ans outputs.conf in your forwarder.
If you have _internal logs, verify that forwarder and indexer are time aligned and that Windows on forwarder create logs (verify policies).

Bye.
Giuseppe

View solution in original post

0 Karma

cmerriman
Super Champion

I have been facing the same issue. Check to make sure your ports are allowed to send data.

go to the Windows Firewall with Advanced Security and check the inbound rules. look for the port your host is on. if it isn't there, add a rule for it, and see if that fixes any issues.

0 Karma

santiagn
Path Finder

thanks! but i should've mentioned that i have cpu load and avail memory already working just the wineventlog stanza wasn't.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi santiagn,
if you want to ingest Windows Event Logs the easiest way is to install on Forwarder Splunk_TA_Windows, enabling only stanzas that you want.

Anyway, in your inputs.conf there isn't any index so try inserting in your search index=main

If there still aren't any logs, verify if your indexer receives logs from the forwarder using this search index=_internal host=your_host
In this way you verify if your forwarder is correctly connected to Indexer.

If not, verify firewalls ans outputs.conf in your forwarder.
If you have _internal logs, verify that forwarder and indexer are time aligned and that Windows on forwarder create logs (verify policies).

Bye.
Giuseppe

0 Karma

santiagn
Path Finder

adding index=main made it work.

thanks so much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...