Key_Events_On_Hosts - Splunk EventType
Posted in Operating Systems, Windows, Tips, Splunk on Monday, July 4, 2016 by cam
Once upon a time Splunk had an “EventType” named “Key_Events_On_Hosts” then one day it disappeared. It used to power some reports that I use. So I had to go find it from a backup. Here is the EventType is all it’s naked glory.
( sourcetype="WinEventLog*" OR sourcetype="XmlWinEventLog*" (Type="*Error*" OR Type="*Fail*" OR EventCode=1074 OR EventCode=19 OR EventCode=20 OR EventCode=21 OR Eventcode=1001) ) OR ( sourcetype="WindowsUpdateLog" (status="installed" OR status="failure" OR status="restart required") )