topic Re: Windows Event Logs and Non Standard Importing in Getting Data In

Windows Event Logs and Non Standard Importing

smvalois — Tue, 30 Sep 2014 13:22:34 GMT

Morning,

We run AD in our environment and the Windows server team does not wish to allow for the use of WMI calls and a service account. They already have a tool called "Event Reporter" which will package windows logs and send them Syslog. Do you know of a way to parse Non standard Windows logs? I either have to figure this out, or remap all the fields by hand using the built in field extractor.

Thank you

Re: Windows Event Logs and Non Standard Importing

smvalois — Tue, 30 Sep 2014 17:29:57 GMT

I know that you can over ride parsers in other products like LogRhyhtm and ArcSight, I am mostly looking to see if i can force a parse on a source, if I know the data type.

Re: Windows Event Logs and Non Standard Importing

ltrand — Wed, 05 Nov 2014 16:00:16 GMT

You can use the props & transforms.conf files to dictate how to parse this automatically.

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Re: Windows Event Logs and Non Standard Importing

mazurmateusz — Mon, 08 Jun 2015 18:52:45 GMT

follow up. How you solve your problem?