Splunk online course

Collect Windows Event Logs from a Local Machine with Splunk

Learn how to configure Splunk on Windows to collect local Application, Security, and System event logs, assign an index, and validate ingestion.

Windows records important operating system, application, security, and user activity as events. Splunk can ingest these events so you can search and analyze them alongside other machine data. This lesson covers the local scenario: Splunk is installed on the same Windows computer whose event logs it collects.

Understand Windows Event Logs

The Windows Event Log is the Windows logging system for significant activity. Examples include successful or failed user logons, application errors, service changes, driver problems, and operating system warnings.

The Windows Event Log service maintains event log data and makes the events available to Windows tools and applications. Event Viewer is the standard Windows administrative interface for browsing local event log channels and reviewing individual events.

An event log channel is a named stream of related events. The most common channels for an initial collection are Application, Security, and System.

How Splunk Collects Local Windows Events

Splunk is a platform that ingests, indexes, searches, and analyzes machine data. Its local event log collection input reads events produced by the Windows Event Log service on the same computer where Splunk runs.

This differs from remote Windows event log collection, where a Splunk component collects logs from another Windows computer. Do not use remote-collection instructions for this lesson.

Only the channels selected in the local event log input are collected. Selecting Application does not automatically collect Security or System.

Check Permissions and the Splunk Service Identity

For this local configuration, the Splunk service must run under the built-in Windows Local System account. Local System is a highly privileged service identity that provides the access required to read local event logs in this scenario.

This requirement is particularly important for the protected Security channel. A service account that cannot read a selected channel cannot send those events to Splunk, even if the channel is selected in the input.

Before creating the input, open Windows Services, locate the Splunk service, and inspect its logon account. Confirm that it is configured to run as Local System. If you change the service identity, restart the service according to your organization's change procedures and verify that the service starts successfully.

Configure Local Event Log Collection in Splunk Web

1. On the Windows computer running Splunk, open Splunk Web.
2. Open Settings, then select Data Inputs.
3. Open the Local event log collection input type.
4. Use the available logs or channels list to select the Windows Event Log channels to monitor. For a basic local setup, select Application, Security, and System.
5. Select the destination index. An index is Splunk's data store and logical search scope. Choose an existing index that follows your organization's data-management practices. If you need to prepare an index first, see Create an Index.
6. Save or enable the input configuration.

Splunk Web labels can vary slightly by Splunk version or installed application, but the workflow remains the same: open Data Inputs, choose local event log collection, select channels, assign an index, and save.

Splunk Web configuration path: Settings > Data Inputs > Local event log collection

Choose Channels for Your Monitoring Goal

Channel selection should match the reason you are collecting data. Application is useful for software troubleshooting, System supports operating system and driver investigations, and Security supports authentication and security monitoring.

• Operational monitoring: Select System and Application to observe services, drivers, operating system issues, and application behavior.
• Troubleshooting: Select Application for application errors and System for service, startup, or driver problems.
• Security monitoring: Select Security and confirm the Splunk service identity and permissions before relying on authentication-related data.

Collecting every available channel may increase storage and search volume. Start with channels that support a defined operational or security requirement, then expand the input when there is a clear need.

Understand the Destination Index

The selected Splunk index determines where the Windows events are stored. It also affects the search scope, who can access the data, how long the data is retained, and how Windows events are separated from other data sources.

Use an appropriate existing index according to local retention, access-control, and naming practices. Record the index name because it is needed when validating the input. For background, read What Is An Index.

Practical Example: Onboard the Three Standard Channels

1. Verify that Splunk is installed on the Windows computer whose logs you want to collect.
2. Verify that the Splunk service runs as Local System.
3. In Splunk Web, open Settings > Data Inputs.
4. Choose Local event log collection.
5. Select Application, Security, and System.
6. Assign the input to the appropriate existing index.
7. Save or enable the input.
8. Generate or identify recent activity, then search the selected index.

Validate Ingested Events

After saving the input, search the destination index over a recent time range. Replace main with the index you selected:

index=main sourcetype=WinEventLog:*

The exact sourcetype and available fields can vary by Splunk version and input configuration. If the broad search returns data, narrow it by channel or inspect the event fields shown in the results. You can also begin with the index alone:

index=main

Confirm all of the following:

• Events have recent timestamps that fit the time range.
• The events originate from the local Windows host.
• Events from each selected channel appear when that channel has recent activity.
• Important event fields, such as the channel, event identifier, host, and message, contain plausible values.

Use Event Viewer as a second source of truth. Open the relevant channel, identify a recent event, and compare its approximate time and details with the Splunk search results. A small delay can occur between event creation and search visibility, so refresh the search after waiting briefly.

Investigate a Recent Application Failure

1. Open Event Viewer and identify a recent error in the Application channel, or reproduce a safe test application error.
2. Search the configured index over a time range that includes the event.
3. Review recent Application events and compare the event time, message, and event identifier with Event Viewer.

This confirms that Application-channel events are being collected rather than merely confirming that another channel is working.

Validate Authentication-Related Data

1. Confirm that Security is selected in the local event log input.
2. Confirm that the Splunk service runs as Local System.
3. Perform or identify a recent sign-in-related event on the local computer.
4. Search the configured index over a suitable time range and look for the corresponding Security activity.

If Application and System events appear but Security events do not, investigate the service identity and channel selection first.

Troubleshoot Missing Events

No local Windows events appear

• Review the Local event log collection input in Settings > Data Inputs and confirm that it was saved and enabled.
• Confirm that at least one channel is selected.
• Search the index assigned to the input, not an assumed default index.
• Widen the time range. The selected channels may not have produced recent events.
• Check Event Viewer for recent activity in the selected channels.
• Confirm that the Splunk service is running.

Security events are missing while other channels work

• Confirm that the Security channel is selected.
• Verify the Splunk service logon account in Windows Services.
• Confirm that the account is Local System and that the service restarted successfully after any identity change.
• Check that the search uses the input's destination index and an appropriate time range.

Event Viewer shows an event but Splunk does not

• Compare the Event Viewer channel with the channels selected in the Splunk input.
• Widen the Splunk search time range.
• Search the intended destination index.
• Recheck the input's index assignment and save state.
• Allow a short ingestion delay, then search again.

Exam-Relevant Notes

• Local collection: Splunk and the Windows event source are on the same Windows computer.
• Service identity: This configuration requires the Splunk service to run as Local System.
• Channel selection: Only selected event log channels are collected.
• Index: The chosen index determines where events are stored and is part of the search scope.
• Validation: Compare recent Splunk results with matching activity in Event Viewer.

For broader Windows data collection, see Windows Inputs. For related collection methods, explore Collect Performance Counters and Collect Windows Host Information.