As you may have noticed, any configuration you make in the Splunk portal corresponds to a *.conf file written to the disk. The same goes for the creation of data inputs; it creates a file called inputs.conf. Now that you have an index to store your machine's Windows Event Logs, let us go ahead and create a data input for it, with the following steps:
Go to the Splunk home page.
Click on your Destinations app. Make sure you are in the Destinations app before you execute the next steps.
In the Splunk navigation bar, select Settings.
Under the Data section, click on Data inputs.
On the Data inputs page, click on the Local event log collection type as shown in the following screenshot:
In the next page select the Application and System log types.
Change the index to
wineventlog. Compare your selections with the following screenshot:
Click Save.
On the next screen, confirm that you have successfully created the data input, as shown in the following screenshot:
Before we proceed further,...