topic Re: Fetching and Filtering Windows Application Logs on App/Eventlog base in Getting Data In

Fetching and Filtering Windows Application Logs on App/Eventlog base

tfechner — Mon, 06 Dec 2021 14:18:16 GMT

Hi,

we like to fetch application logs from a windows server which are stored Windows Event Store in windows-application.

Windows Application Event Log Name : MSSQL_xxx
Windows Event Log Source : XYX

I found:

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowseventlogdata#Specify_global_settings_for_Windows_Event_Log_inputs

But is there a possibility to filter in the input-stanza like this

[WinEventLog://Application/MSSQL_xxx]
include = XYX
renderXml=1
sourcetype=XmlWinEventLog

Thanks.

Re: Fetching and Filtering Windows Application Logs on App/Eventlog base

tfechner — Mon, 06 Dec 2021 14:30:29 GMT

some more infos:

The path is not in "Windws Logs" (where Application, Systen Security ist located). The path is on the top-level with "Application and Services Logs", there is a new section "MSSQL_xxx". There you find the logs I need

Re: Fetching and Filtering Windows Application Logs on App/Eventlog base

PickleRick — Mon, 06 Dec 2021 15:38:19 GMT

Yes, you can do it. You just need the name of the Log.

You browse in your Event Viewer to the log, click RMB on it, get into properties. And there you have field called "Full Name". That's what you need to put in your WinEventLog:// stanza.

Sometimes the name matches with the name displayed in the main EventViewer tree but sometimes it doesn't.

Re: Fetching and Filtering Windows Application Logs on App/Eventlog base

tfechner — Tue, 07 Dec 2021 06:52:32 GMT

so you meen like this:
[WinEventLog://C:\windows\System32\Winevt\Logs\MSSXXXXX.evtx]

Re: Fetching and Filtering Windows Application Logs on App/Eventlog base

PickleRick — Tue, 07 Dec 2021 07:47:51 GMT

No. The other field 🙂

Re: Fetching and Filtering Windows Application Logs on App/Eventlog base

tfechner — Fri, 10 Dec 2021 08:37:00 GMT

we will try this - will take some time as holiday season is reaching