topic Re: Can the Splunk Add-on for Sysmon work with a file input on a Heavy Forwarder ? in Getting Data In

Can the Splunk Add-on for Sysmon work with a file input on a Heavy Forwarder ?

whardy — Wed, 18 Jan 2023 09:41:33 GMT

I would like to be able to configure the Splunk Add-on for Sysmon to ingest logs from a file instead of the Windows Event Log directly. The default input.conf in the Splunk Add-on for Sysmon App contains the following:

[WinEventLog://WEC-Sysmon]
disabled = true
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype = XmlWinEventLog:WEC-Sysmon
host = WinEventLogForwardHost

I tried to override the input like so:

[monitor:///path/to/my_file/filename.log]
disabled = false
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype = XmlWinEventLog:WEC-Sysmon
host = WinEventLogForwardHost

Unfortunately, it doesn't work and no logs appear to be sent by the Heavy Forwarder to my Indexer. the file I am using contains Windows Logs in a standard Windows Event Log XML format (1 per line). I want to be CIM compliant with my Sysmon logs but I cannot use a WinEventLog:// input, I have to use a file input.

Re: Can the Splunk Add-on for Sysmon work with a file input on a Heavy Forwarder ?

wmazur-splunk — Wed, 18 Jan 2023 11:24:13 GMT

Probably it won't work.

Try "regular" approach: Settings -> Data Input -> Upload files from computer, select `XmlWinEventLog:WEC-Sysmon` as a source type in second step (Set Source Type).

You can select source type from any installed add-on. Splunk will try to digest the input according to the expected source type.

Re: Can the Splunk Add-on for Sysmon work with a file input on a Heavy Forwarder ?

whardy — Wed, 18 Jan 2023 14:55:39 GMT

This is not an option since the file is constantly being updated with new logs and manually uploading the file is not an option.

Re: Can the Splunk Add-on for Sysmon work with a file input on a Heavy Forwarder ?

wmazur-splunk — Wed, 18 Jan 2023 16:06:00 GMT

Splunk covers that as well. Select "Monitor" instead of "Upload".

https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/MonitorfilesanddirectorieswithSplunkWeb.

https://youtu.be/b2Kztj03hBc