Getting Data In

Why are some Windows Security events not logging in Splunk?

Jordan54
New Member

I have a UF setup on a windows 2012 server. I am logging Win sec logs but I see some in the event viewer that are not going into splunk.. How can I get all the logs to go into Splunk from the windows server?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi Jordan54
You have to find in your inputs.conf of Splunk_TA_Windows if there are some blacklist or whitelist.
after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled).
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Jordan54
You have to find in your inputs.conf of Splunk_TA_Windows if there are some blacklist or whitelist.
after, identify which events are in Event Viewer and not in Splunk and check which stanza shopuld take them (maybe is disabled).
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...