I found the solution. for getting logs on-boarded from the path: C:\Windows\System32\winevt\Logs\Microsoft-Windows-DNSServer%4Audit.evtx. We need below stanza in inputs.conf on universal forwarder: [WinEventLog://Microsoft-Windows-DNSServer/Audit] checkpointInterval = 5 current_only = 0 disabled = 0 index = start_from = oldest Add your comment... ... View more

I found the solution. for getting logs on-boarded from the path: C:\Windows\System32\winevt\Logs\Microsoft-Windows-DNSServer%4Audit.evtx. We need below stanza in inputs.conf on universal forwarder: [WinEventLog://Microsoft-Windows-DNSServer/Audit] checkpointInterval = 5 current_only = 0 disabled = 0 index = start_from = oldest ... View more

above answer is not valid for consecutive failed attempts ... View more