Splunk Add-on for Sysmon : Sysmon events are not getting ingested

Available Languages

Updated:September 29, 2026
Document ID:SPLK047166

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Splunk Cloud

Description

Sysmon events from the Windows host are not ingesting into Splunk through the Splunk Add-on for Sysmon, despite the input configuration being set up as per the documentation.

Refer to the below input stanza : 

[WinEvent Log://Microsoft-Windows-Sysmon/Operational]
disabled = 0 
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
index = index_name

Investigation

Upon further investigation, found the below logs :

SPL :

index=_internal source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational "*ERROR*"

Error Log :

08-13-2024 15:51:09.479 +0200 ERROR ExecProcessor [2828 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventLogChannel::subscribeToEvtChannel: Could not subscribe to Windows Event Log channel 'Microsoft-Windows-Sysmon/Operational'
 
08-13-2024 15:51:09.479 +0200 ERROR ExecProcessor [2828 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventLogChannel::init: Init failed, unable to subscribe to Windows Event Log channel 'Microsoft-Windows-Sysmon/Operational': errorCode=5

The error message indicates that Splunk is having trouble subscribing to the Windows Event Log channel Microsoft-Windows-Sysmon/Operational from Windows machine.

The specific error code errorCode=5 suggests that this is a permissions issue.

The above Error means the below:

splunk-winevtlog - WinEventLogChannel::subscribeToEvtChannel:: This part of the error message indicates that Splunk's Universal Forwarder (UF) is trying to subscribe to a specific Windows Event Log channel.

Could not subscribe to Windows Event Log channel 'Microsoft-Windows-Sysmon/Operational': Splunk is unable to access the Microsoft-Windows-Sysmon/Operational log, which is where Sysmon events are recorded.

errorCode=5: The error code 5 typically corresponds to "Access Denied." This means that the Splunk process does not have sufficient permissions to access the Windows Event Log channel.

Keep in mind that Sysmon log events are considered High value events, like security logs. This can be checked under Chanel Access.

On newer machines, the service is configured to start as "NT SERVICE\SplunkFowarder", and some configured data sources (like Sysmon for example) have denied access.

 


Resolution

To resolve this error:

  1. Check the User Account Running Splunk:

    • Ensure that the Splunk Universal Forwarder service on the Windows machine is running under an account that has the necessary permissions to access the Windows Event Log, particularly the Microsoft-Windows-Sysmon/Operational channel.
    • The user account should have administrative privileges or, at the very least, have specific permissions to read the Sysmon event logs.

  2. Grant the Necessary Permissions:

    • Open the Event Viewer on the Windows machine.
    • Navigate to Applications and Services Logs --> Microsoft --> Windows --> Sysmon --> Operational.
    • Right-click on Operational and select Properties.
    • Under the Security tab, ensure that the account running the Splunk Universal Forwarder has Read access to the Sysmon log. You may need to add this account if it is not listed.

  3. Run Splunk as an Administrator:

    • If you're not already doing so, try running the Splunk service under the Local System account or an administrator account that has full access to the Windows Event Logs.

  4. Verify Event Log Subscription:

    • Ensure that the Microsoft-Windows-Sysmon/Operational log is properly enabled and that events are being generated.
    • You can do this by checking the Event Viewer under the Sysmon log to ensure events are being recorded.

  5. Restart the Splunk Universal Forwarder:

    • After making the necessary permission changes, restart the Splunk Universal Forwarder service to apply the new settings.


If SplunkForwarder is running with virtual account, there is also a way to enable reading of sysmon logs. NT SERVICE/SplunkFowarder needs to be added to Event Log Readers group.

One of the ways is to add it to the Group policy and deploy it across your environment where your Forwarders are installed. 

This should help resolve the issue with subscribing to the Sysmon Event Log channel in Splunk.

 

Splunk Add-on for Sysmon
Sysmon events

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles