topic Re: Can we upload or by input data by files or directory we can monitor eventlogs (evtx) files? in Splunk Dev

Can we upload or by input data by files or directory we can monitor eventlogs (evtx) files?

RAVIKR — Mon, 30 Jul 2018 16:38:20 GMT

In the process , Splunk is able to read the file but that inst in human readable format.I am Using this approach because SPlunk forwarder isn't installed on the server from whose event logs we want to monitor.

Re: Can we upload or by input data by files or directory we can monitor eventlogs (evtx) files?

sudosplunk — Mon, 30 Jul 2018 16:57:05 GMT

Hello,

Short answer is no. Please have a look at my other answer for workaround.

https://answers.splunk.com/answers/673824/index-exported-evt-evtx-files.html

Re: Can we upload or by input data by files or directory we can monitor eventlogs (evtx) files?

adonio — Mon, 30 Jul 2018 17:08:19 GMT

if you cant install a forwarder on that particular windows machine, find a windows machine you CAN!
forward windows event logs to the machine that has the Universal Forwarder on it, use the splunk TA for windows and have it monitor the "Forwarded Events" data