I'm using Splunk Light as an indexer, Splunk Heavy Forwarder for filtering and forwarding and the Splunk Universal Forwarder on a Windows 2012 machine (not on the domain) to test Windows events.
I installed the Universal Forwarder on the Windows system and had it log everything, sending the data to the Heavy Forwarder. Except for having to install the Windows add-on (which I think built the indexes?), everything seemed to work ok.
I uninstalled the Universal Forwarder and reinstalled it to capture only the Security log events. But they're not showing up.
I edited inputs.conf, for some reason it only has this by default:
[default]
host = CA3SYSBSCAN01
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
I added
[WinEventLog:Security]
disabled = 0
And restarted the agent, to no effect.
I've uninstalled, rebooted, reinstalled, stopped the agent, cleared the event logs, started the agent. It's not clear to me what's going wrong. This should be easy right?
Security event logs show up fine in the Event Viewer. I even installed nxlog as an experiment and it forwards events fine. (With its own set of problems... I would prefer the Splunk UF)
There must be a troubleshooting step I'm missing. How can I check the event volumes being observed and transmitted by the Universal Forwarder? How can I see if they're properly received on the Heavy Forwarder? That I have the right indexes installed on the Splunk Light indexer?
Thanks,
↧