topic Re: On a Linux Splunk Server, how do I ingest Windows CIFS audit files in Getting Data In

On a Linux Splunk Server, how do I ingest Windows CIFS audit files

rruth — Thu, 08 Oct 2015 22:05:34 GMT

I have adtlog.evt files I wish to look at from Splunk. How do I do this without using a Windows Splunk server? (I do have universal forwarders on some Windows systems if I need to go that route.) My Splunk server resides on Linux.

Details: I have a Netapp filer with CIFS mounts creating the adtlog.evt files and I want to use Splunk to search them.

Re: On a Linux Splunk Server, how do I ingest Windows CIFS audit files

Richfez — Fri, 09 Oct 2015 00:48:45 GMT

I don't think this will be easy. You could try something like evtviewer. Note I am not endorsing this, just suggesting it as a way to read those files. I have no idea how you would get that to export the files into a better format. To be honest, I'm not even sure Windows would have an easy way to do this.

Can you have it pick a different logging format? Does the control station (or whatever Netapp uses to "control" the filer) have a console you can get onto? Can you install software there? Does it have another log folder somewhere?

Re: On a Linux Splunk Server, how do I ingest Windows CIFS audit files

rruth — Tue, 13 Oct 2015 17:50:54 GMT

Splunk tech supported pointed me here:

https://answers.splunk.com/answers/28847/how-do-we-index-netapp-evt-files-on-a-unix-box.html