topic Re: Splunk Metadata for Windows EVTX Files in Getting Data In

Splunk Metadata for Windows EVTX Files

sdwilkerson — Thu, 21 Oct 2010 07:05:20 GMT

I am at a site where we are using a Splunk Forwarder to mount a DFS share and read EVTX Archive Files placed there by another entity.

The Splunk Forwarder is 4.1.5 x64 on Windows 2008. The Splunk Forwarder is also a Search Head federating search requests to the same indexer where it is sending these evtx logs (not that it should make a difference).

There are no problems with the reads/parse of the EVTX files; however, we appear to have a problem with modifying the Splunk Metadata for these events.

Ideally, we would customize the Index field. This appears to not work.

In the inputs.conf I have tried setting the index and the sourcetype but no matter what I enter, here is where the events show up:

index=main
sourcetype=WinEventLog:Security

I have also tried using props/transforms to set the Metatdata DEST_KEY on both the Forwarder and the Indexer (several ways). No matter, what I select or set, it appears that I can have no impact on the index or sourcetype.

My thought is that since the evtx files are binary, that a separate process handles these that isn't accepting modification.

Is this crazy or some limitation of the (evt|evtx) parser?

Sean

Re: Splunk Metadata for Windows EVTX Files

Ledio_Ago — Thu, 21 Oct 2010 08:07:17 GMT

Sean, that is true. You can't set index, source or any other metadata for ".evt(x)" type inputs. There is a special process that does the parsing, instead of the tailing processor, and it doesn't support setting those type of metadata.

This has been fixed and will be shipped with next major version of Splunk, 4.2

Thanks, Ledio

Re: Splunk Metadata for Windows EVTX Files

sdwilkerson — Thu, 21 Oct 2010 08:20:09 GMT

Ledio,
Much appreciated. I thought I was going nuts. Wish the docs had warned me.
Sean

Re: Splunk Metadata for Windows EVTX Files

Ledio_Ago — Thu, 21 Oct 2010 23:07:32 GMT

That's a good point. I will send this to the docs team and them updated.

Thanks!

Re: Splunk Metadata for Windows EVTX Files

malmoore — Fri, 22 Oct 2010 02:51:25 GMT

Done. (from the docs team)