{"action":"opened","issue":{"url":"https://api.github.com/repos/MHaggis/sysmon-splunk-app/issues/2","repository_url":"https://api.github.com/repos/MHaggis/sysmon-splunk-app","labels_url":"https://api.github.com/repos/MHaggis/sysmon-splunk-app/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/MHaggis/sysmon-splunk-app/issues/2/comments","events_url":"https://api.github.com/repos/MHaggis/sysmon-splunk-app/issues/2/events","html_url":"https://github.com/MHaggis/sysmon-splunk-app/issues/2","id":223625390,"number":2,"title":"Sysmon for Splunk App not displaying any data from Windows Event Collector forwarded logs. ","user":{"login":"johnyb0312","id":17878047,"avatar_url":"https://avatars1.githubusercontent.com/u/17878047?v=3","gravatar_id":"","url":"https://api.github.com/users/johnyb0312","html_url":"https://github.com/johnyb0312","followers_url":"https://api.github.com/users/johnyb0312/followers","following_url":"https://api.github.com/users/johnyb0312/following{/other_user}","gists_url":"https://api.github.com/users/johnyb0312/gists{/gist_id}","starred_url":"https://api.github.com/users/johnyb0312/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnyb0312/subscriptions","organizations_url":"https://api.github.com/users/johnyb0312/orgs","repos_url":"https://api.github.com/users/johnyb0312/repos","events_url":"https://api.github.com/users/johnyb0312/events{/privacy}","received_events_url":"https://api.github.com/users/johnyb0312/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-04-23T10:01:26Z","updated_at":"2017-04-23T10:01:26Z","closed_at":null,"body":"Sysmon for Splunk App not displaying any data from Windows Event Collector (we are using Windows Event Collector as a single forwarder). How might I troubleshoot and reconfigure if necessary in my deployed environment?  \r\n\r\nSysmon data is in Splunk.\r\nsourcetype =\tWinEventLog:ForwardedEvents\r\n\r\nI can see logs in Splunk when I search under  the data feed Host (in my environment is is called): WinEvtCollector\t\t\r\n\r\nI tried to adjust the macro using the above sourcetype but that did not work. I think I'm missing some fundamental piece of info here.\r\n\r\nMaybe because I'm collecting my logs from a single Windows Event Forwarder and not the individual boxes themselves (maybe)?\r\n\r\nIt looks like the app is based on the idea that a person would be sending their logs from the windows box straight into the Splunk instance and not through a Windows Event Collector.\r\n\r\nCan you provide me any help in understanding this so that I can utilize your app? It looks amazing."}}
{"actor":{"display_login":"johnyb0312"}}