No more failed windows audit entries in search

[jlford30]

So I have forwarders installed on my Domain Controllers and the splunk service is running. For some reason as of a month ago I stopped seeing all my failed audit logs from the security log in the DC showing up in splunk, it is in the event viewer on the DC but not in splunk. I've restarted both services, on the search head and the forwarder

[kristian_kolb]

You might have to clarify a little bit;

a) Are you not seeing ANY events from the DC, OR
b) you are seeing events from other logs, but none from the WinEventLog:Security, OR
c) you are seeing some of the events from the WinEventLog:Security but not all?

if a) check inputs.conf and outputs.conf on the forwarder, firewalls between forwarder and indexer

if b) check inputs.conf on the forwarder

if c) check props.conf and transforms.conf on the machine where parsing takes place. If the forwarder is a Heavy Forwarder, check there. If the forwarder is a Universal or Lighweight forwarder, check the Indexer.

---

UPDATE:

so it seems like a b) scenario.

Somewhere on your forwarder there is an inputs.conf file that specifies that WinEventLog:Application is to be collected. Find that file and more or less copy the section and replace 'Application' with 'Security'.

• Other than that, you could always look at the splunkd.log for errors.
• On the forwarder type splunk list monitor and see what turns up.
• Check out the REST interface of the forwarder to see what it's trying to monitor; https://hostname:8089/services/admin/inputstatus/TailingProcessor:FileStatus

Hope this may help shed some light,

Kristian

[kristian_kolb]

What is the sourcetype of the WinEventLogs you are getting?
WMI.... or WinEventLog:Security?

[jlford30]

This is all I see for inputs.conf in the /etc/system/local

[default]
host = HQDC01

[script://$SPLUNK_HOME\bin\scripts\splunk-admon.path]
disabled = 0

[jlford30]

I'm seeing application but not Security logs. So it isn't a firewall issue.

What should I be looking for in the input.conf?