topic How to add Windows Event Log Adaxes.evtx as an input? in Getting Data In

How to add Windows Event Log Adaxes.evtx as an input?

pkeller — Fri, 24 Feb 2017 00:13:49 GMT

I have some folks that want me to ingest Adaxes events under: Application and Services Logs -> Adaxes

I'm not quite sure how to construct the inputs. The example below would just be a shot in the dark.

[WinEventLog://Applications and Services/Adaxes]

Thank you

Re: How to add Windows Event Log Adaxes.evtx as an input?

jlvix1 — Fri, 24 Feb 2017 10:11:25 GMT

Have you tried it?

Don't forget to add disabled=0 underneath it and you may need to add another / where there is only one?

Generally, I find that using UF's you are limited in choice to what is in the web interface on the HF when configuring from there, like app, sec and sys logs, no access to custom logs.

If you use a HF and get it to reach out directly via WMI or grab from local, you have more options and getting that input should be no problem.

If you're using inputs.conf then this link helps: http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/MonitorWindowseventlogdata

Re: How to add Windows Event Log Adaxes.evtx as an input?

pkeller — Fri, 24 Feb 2017 19:15:48 GMT

... This worked

[WinEventLog://Adaxes]
disabled = 0

Thank you.
Paul