topic Re: Windows eventid csv file for Splunk lookup? in Getting Data In

Windows eventid csv file for Splunk lookup?

maverick — Fri, 30 Jul 2010 03:24:04 GMT

Does anyone happen to have (or know where I can find) a csv file that contains the various Windows security eventids and their matching humanly-readable meanings so I can use it as my lookup file?

If not, then where is the best page on msdn.com to look for the listing myself so I can compile one?

If I make one myself, then I will share it on splunkbase as an add-on.

Therefore, you can think of it as you are helping me to help you. 🙂

Re: Windows eventid csv file for Splunk lookup?

ftk — Fri, 30 Jul 2010 03:31:17 GMT

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx

Almost CSV format already!

Re: Windows eventid csv file for Splunk lookup?

muebel — Fri, 30 Jul 2010 03:56:29 GMT

http://pastie.org/1066138.txt

Link to CSV mapping eventcode to event description^

Re: Windows eventid csv file for Splunk lookup?

maverick — Fri, 30 Jul 2010 04:49:16 GMT

Thanks! This will help.

Re: Windows eventid csv file for Splunk lookup?

maverick — Fri, 30 Jul 2010 04:50:15 GMT

WOW! Thanks! I appreciate it!

Re: Windows eventid csv file for Splunk lookup?

djemodjenai — Wed, 18 Mar 2020 08:31:38 GMT

This pastie link may be down.

Re: Windows eventid csv file for Splunk lookup?

splk — Tue, 24 Mar 2020 12:34:47 GMT

https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/Lookups