VMware ESXi and vSphere Cluster Management

Monitor Remote Windows Event Logs with a Splunk Forwarder

Learn how to configure a Splunk Universal Forwarder on Windows to collect Security, Application, and System event logs and send them to the remotelogs index.

Centralized Windows Event Log monitoring lets administrators and security analysts search events from multiple Windows machines in one Splunk environment. This lesson shows how to configure a Splunk forwarder on a Windows host to collect the Security, Application, and System channels and send them to a dedicated index named remotelogs.

A Splunk forwarder is a lightweight Splunk component installed on a data source. The commonly used Universal Forwarder reads local data and forwards it to another Splunk instance. In this design, the forwarder reads Windows Event Logs on the Windows machine; the indexer does not remotely query Event Viewer.

For related guidance, see Monitor Remote Windows Event Logs.

Architecture and Data Flow

The main components are:

  • Windows source host: Runs the Windows Event Log service and the Splunk forwarder.
  • Splunk forwarder: Reads selected local Event Log channels and sends events over the network.
  • Splunk receiver or indexer: Accepts forwarded events and writes them to Splunk storage.
  • Destination index: Organizes the events for searching, retention, access control, and capacity management. This lesson uses remotelogs.

The data flow is:

  1. The Windows Event Log service records an event in a channel such as Security, Application, or System.
  2. A matching WinEventLog input stanza tells the forwarder to read that channel.
  3. The forwarder sends the event to its configured Splunk receiving endpoint.
  4. The receiving Splunk instance indexes the event in the configured destination index.

The input configuration determines what the forwarder collects and which index receives it. The output configuration determines where the forwarder sends collected data. Both parts are required: a correctly configured input cannot deliver data if forwarding to the receiver is unavailable.

Prerequisites

  • A Splunk Universal Forwarder or another appropriate Splunk forwarder is installed on the Windows source machine.
  • The forwarder has output forwarding configured for a Splunk receiver or indexer.
  • The Windows host can connect to the receiving Splunk instance through the required network path and port.
  • The destination index remotelogs exists and is available on the indexing tier.
  • The forwarder service account has sufficient Windows permissions to read the selected Event Log channels. Security log access commonly requires more permission than Application or System log access.
  • You can edit the forwarder's configuration and restart its service.
  • You understand basic Splunk search syntax, including selecting an index.

Windows Event Logs to Collect

Windows Event Logs are structured records viewed through Event Viewer. A channel groups events by their source and purpose.

  • Security: Authentication, authorization, auditing, and other security-related activity.
  • Application: Errors, warnings, and informational events generated by applications.
  • System: Operating-system, service, driver, and other system-component events.

Each channel gets its own input stanza. The stanza name identifies the Windows Event Log channel, while the index setting assigns the collected events to a Splunk index.

Collection Plan

Event Log channel | Typical event types | Input stanza | Destination index

Security | Authentication, authorization, auditing, and security activity | [WinEventLog://Security] | remotelogs

Application | Application errors, warnings, and informational events | [WinEventLog://Application] | remotelogs

System | Operating-system, service, driver, and system-component events | [WinEventLog://System] | remotelogs

Configure inputs.conf

inputs.conf is the Splunk configuration file used to define data inputs, including Windows Event Log collection. On a Windows Universal Forwarder, place the configuration in the appropriate application or local configuration directory, commonly the local directory of the app that owns the input configuration. Use the forwarder's actual installation path and follow your deployment's configuration-management conventions.

Create one WinEventLog stanza for each channel. A stanza is a named configuration section. The following example enables the three primary channels and routes all of them to remotelogs:

[WinEventLog://Security]
disabled = 0
index = remotelogs

[WinEventLog://Application]
disabled = 0
index = remotelogs

[WinEventLog://System]
disabled = 0
index = remotelogs

In this configuration:

  • [WinEventLog://Security], [WinEventLog://Application], and [WinEventLog://System] identify the channels.
  • disabled = 0 enables each input.
  • index = remotelogs routes all three inputs to the dedicated index.

To monitor another Windows channel, add another stanza using the same pattern and replace the channel name. Collect additional channels only when they support a defined operational, compliance, or security requirement.

Apply the Configuration

  1. Save the edited inputs.conf in the forwarder's appropriate configuration location.
  2. Check that the stanza names are spelled exactly as the Windows Event Log channel names.
  3. Restart the forwarder so it reloads the input configuration.
splunk restart

After the restart, confirm that the forwarder returns to a running state. A restart that fails or leaves the service stopped prevents collection and forwarding.

Verify Indexed Events

Start with a broad Splunk search scoped to the destination index:

index=remotelogs

Set an appropriate time range and confirm that events are returned. Inspect event metadata to identify the source Windows host and distinguish the channels. Useful fields include:

  • host: The host identity recorded by Splunk.
  • source: Often identifies the Windows channel, such as WinEventLog:Security.
  • sourcetype: Identifies the event data format used by Splunk.
  • Event channel fields: May expose the channel name depending on the forwarder and parsing configuration.

To focus on a particular host and Security channel, use a search such as:

index=remotelogs host=<windows_host> source="WinEventLog:Security"

Replace <windows_host> with the actual host value returned in your environment. Repeat the validation for Application and System events by changing the source filter when appropriate.

Configuration and Verification Checklist

Step | Location or command | Expected result

Edit inputs.conf | Forwarder's appropriate configuration directory | Three enabled WinEventLog stanzas assign events to remotelogs

Restart forwarder | splunk restart | Forwarder reloads the inputs and returns to a running state

Run index search | index=remotelogs | Forwarded Windows events are returned

Confirm events and host identity | Inspect host, source, sourcetype, and channel fields | Security, Application, and System data are associated with the expected Windows host

Operational Considerations

  • Use a dedicated index: Separating remote Windows logs from unrelated data simplifies searches, permissions, retention, and reporting.
  • Plan retention: Security logs can be high volume. Size storage and retention policies according to event rate and investigation requirements.
  • Control access: Apply suitable role-based access controls to security-sensitive Windows events.
  • Limit unnecessary volume: Do not collect channels that do not support a defined need. Add channels deliberately and review their event rates.
  • Monitor forwarder health: Review service status, forwarding connectivity, and forwarder logs when events stop arriving.

Troubleshooting

No Events Appear in remotelogs

Likely causes include an unrestarted forwarder, a disabled or misspelled input stanza, missing output forwarding, network connectivity problems, or an unavailable destination index.

  1. Verify that each WinEventLog stanza is enabled and uses the correct channel name.
  2. Restart the forwarder and confirm its service status.
  3. Check forwarder logs for connection, output, or input errors.
  4. Confirm that the receiver is reachable and that its forwarding configuration is active.
  5. Verify that remotelogs exists and is available for incoming data.
  6. Search broadly with index=remotelogs before adding host or source filters.

Security Events Are Missing

If Application and System events arrive but Security events do not, the forwarder service account may lack permission to read the Security channel. The Security stanza may also be absent, disabled, or incorrectly named, or Windows auditing may not be generating the activity being tested.

  • Confirm that the forwarder service account has suitable access to the Security Event Log.
  • Verify that the Security stanza is exactly [WinEventLog://Security] and has disabled = 0.
  • Confirm that the relevant Windows auditing policy is enabled and is generating test events.
  • Search specifically for Security events after performing a known test action.

Events Arrive but the Expected Search Finds Nothing

The events may be in another index, have different metadata values, or fall outside the selected time range.

  • Run index=remotelogs without host or source filters.
  • Inspect returned events to learn the actual host, source, and sourcetype values.
  • Expand the time range and search again.
  • Confirm that the input's index assignment matches the index used in the search.

Exam-Relevant Notes

  • A forwarder collects the data locally on the Windows host; an indexer does not remotely poll Event Viewer.
  • Each Windows Event Log channel requires its own WinEventLog input stanza.
  • inputs.conf defines collection, while output configuration defines the receiving Splunk endpoint.
  • The index setting in each input stanza determines the destination Splunk index.
  • After changing input configuration, restart the forwarder and verify that it is running.
  • Use a broad index search first, then narrow by host, source, or sourcetype.