topic How to parse windows server logs with .conf file as well as with rex? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-parse-windows-server-logs-with-conf-file-as-well-as-with/m-p/120777#M25075 <P>I am using a windows server which is configured with forwarder.<BR /> Now I need all those logs on my desktop from where I want to monitor these logs.<BR /> Through indexers I will be passing those logs.<BR /> Please help me out for parsing such logs.<BR /> (Note: Latest version of windows server is being used)</P> Fri, 22 May 2015 11:05:25 GMT Mayuresh1516 2015-05-22T11:05:25Z How to parse windows server logs with .conf file as well as with rex? https://community.splunk.com/t5/Getting-Data-In/How-to-parse-windows-server-logs-with-conf-file-as-well-as-with/m-p/120777#M25075 <P>I am using a windows server which is configured with forwarder.<BR /> Now I need all those logs on my desktop from where I want to monitor these logs.<BR /> Through indexers I will be passing those logs.<BR /> Please help me out for parsing such logs.<BR /> (Note: Latest version of windows server is being used)</P> Fri, 22 May 2015 11:05:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-windows-server-logs-with-conf-file-as-well-as-with/m-p/120777#M25075 Mayuresh1516 2015-05-22T11:05:25Z Re: How to parse windows server logs with .conf file as well as with rex? https://community.splunk.com/t5/Getting-Data-In/How-to-parse-windows-server-logs-with-conf-file-as-well-as-with/m-p/120778#M25076 <P>Where is the forwarder configured to send the data (outputs.conf)?<BR /> You don't ever "need all those logs on your desktop"; they will go into an indexer which will do your bidding when you access it's data through your browser ("on your desktop").<BR /> The indexer will not "pass the logs"; the indexer is the final destination for them.<BR /> As far as "parsing", I assume you already have a "rex" command working so you can convert this to an automatic field extraction with props.conf:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf</A></P> Sun, 24 May 2015 12:44:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-windows-server-logs-with-conf-file-as-well-as-with/m-p/120778#M25076 woodcock 2015-05-24T12:44:31Z