topic Re: How to ingest Archived Event logs? in Getting Data In

How to ingest archived event logs?

aikn061 — Wed, 08 Feb 2023 17:28:32 GMT

Hi there,

So we have one of our event logs set to archive. But there were some files that are already there before we started ingesting this log.

So if I want to bring these logs in to splunk how do you do it? I understand in this case UF and WI are only options.

So I did deploy the below with deployment server and restarted deploy-server. But this log did not make it to splunk. Any ideas what could be the problem? or any other way I can bring in exported/archived event logs in to splunk?

[monitor://C:\windows\system32\winent\logs\Archive_log.evtx]
disabled = 0
index=idx

Re: How to ingest Archived Event logs?

2MuchC0ff33 — Wed, 08 Feb 2023 03:30:58 GMT

Interesting question, @aikn061,

I read the document you hyperlinked in your post and did some further poking myself.

Have you tried directly calling the Windows event log APIs from a script and sending the logs to Splunk via the HTTP Event Collector (HEC)?

If not, here are the additional articles I looked at:

Let me know how you get on; I'd love to hear your thoughts.

Re: How to ingest Archived Event logs?

shivanshu1593 — Wed, 08 Feb 2023 17:20:34 GMT

Splunk docs specify that you cannot monitor Windows event log (*.evt) files with a [monitor://] stanza as they are in binary format. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files.

Not really sure if you can monitor the archived logs, but maybe try modifying the following stanza from the docs for the archived logs and see if it helps.

Use the Full Name log property in Event Viewer to specify complex Event Log channel names properly You can use the Full Name Event Log property in Event Viewer to ensure that you specify the correct Event Log channel in an inputs.conf stanza. For example, to monitor the Task Scheduler application log, Microsoft-Windows-TaskScheduler-Operational, do the following steps: Open Event Viewer. Expand Applications and Services Logs > Microsoft > Windows > TaskScheduler. Right-click Operational and select Properties. In the dialog that appears, copy the text in the Full Name field. Append this text into the WinEventLog:// stanza of inputs.conf as in the following example: [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0

More information on the same: https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/MonitorWindowseventlogdata