topic Re: define input.conf in Getting Data In

define input.conf

smanojkumar — Tue, 31 Oct 2023 12:04:07 GMT

Hi Splunkers!

I would like to know how to define a .evtx file,

I had defined in this way, but it didn't works

[monitor://C:\Windows\System32\Winevt\Logs\Data Security.evtx]

Thanks!

gcusello — Tue, 31 Oct 2023 12:07:07 GMT

let me understand: you need to index WinEvenLog events, is it correct?

in this case you don't need to monitor an evtx file but there's a dedicated collector.

More more infos see at

Ciao.

Giuseppe

isoutamo — Thu, 02 Nov 2023 12:23:20 GMT

On windows node just define that input on inputs.conf like @gcusello told. There are examples on those documents.

r. Ismo