topic Re: Windows app and Windows 2008 evtx logs in All Apps and Add-ons

Windows app and Windows 2008 evtx logs

gsawyer1 — Fri, 20 Aug 2010 23:31:56 GMT

Does the windows app work with 2008 event log files? Is the Windows app the best way to monitor windows logs?

Re: Windows app and Windows 2008 evtx logs

gkanapathy — Sat, 21 Aug 2010 00:45:15 GMT

The Windows app is the best way to monitor Windows Event Logs, but it doesn't monitor the evtx files. (The files are [or can be] created by the Event Logging system, but the Splunk WinEventLog monitor talks directly to the Event Logging system rather than looking.)

Re: Windows app and Windows 2008 evtx logs

gsawyer1 — Tue, 24 Aug 2010 22:17:00 GMT

So then what is the recommended method for ingesting evtx files from Windows 2008? Also, when I enable and configure the Windows App to monitor my event logs, on both 2003 and 2008 servers, nothing is getting ingested. I verified that my account has full control over the Splunk installation directory. I am now manually entering the Windows stanzas in the inputs.conf file....