Are there limitations for a Splunk Indexer on Linux indexing imported Windows Event Logs?

thomas_porter — Tue, 14 Feb 2017 20:30:57 GMT

I referenced a prior question on this regarding Linux Splunk server and Windows Event Logs: https://answers.splunk.com/answers/60343/linux-splunk-server-and-windows-event-logs.html

But this is more than 4 years old and I am hoping there might be a new app out there.

In addition to native network monitoring through forwarders, we expect to receive Windows event logs in the native format (.evtx) on DVD. My indexer is on a Centos box. Do I still have to go through the "wevtutil" command to convert to XML, or is there a Splunk app that will allow me to ingest those native event logs directly?

Re: Are there limitations for a Splunk Indexer on Linux indexing imported Windows Event Logs?

mgnzlz — Thu, 16 Mar 2017 20:31:18 GMT

HI,

No that was an old threat i just finished a project using this environment and everything is good, as a charm. So dont worry, all you will need is Splunk universal forwarders on windows machines.

Melvin Gonzalez
Security Consultant

topic Are there limitations for a Splunk Indexer on Linux indexing imported Windows Event Logs? in Getting Data In

Are there limitations for a Splunk Indexer on Linux indexing imported Windows Event Logs?

Re: Are there limitations for a Splunk Indexer on Linux indexing imported Windows Event Logs?