topic Re: How can I upload an Administrative Events.evtx file? in Getting Data In

How can I upload an Administrative Events.evtx file?

ddrillic — Tue, 08 Aug 2017 21:29:40 GMT

We are trying to upload the Administrative Events.evtx file via the Add Data interface. However, the interface doesn't seem to provide the option to treat the file as a Windows events log file.

We see -

Any ideas?

Re: How can I upload an Administrative Events.evtx file?

lfedak_splunk — Tue, 08 Aug 2017 21:54:34 GMT

Hey @ddrillic, Here's some documentation on adding this type of file. http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

Re: How can I upload an Administrative Events.evtx file?

ddrillic — Tue, 08 Aug 2017 21:56:42 GMT

Great, but I would like to upload them as files and not monitor them, which we can't at this point...

Re: How can I upload an Administrative Events.evtx file?

lfedak_splunk — Tue, 08 Aug 2017 21:57:20 GMT

Here are a few Answers links as well:
Through the interface: https://answers.splunk.com/answers/528735/how-to-index-exported-evt-and-evtx-files.html
Using a forwarder or using a work-around to change them into csv or text files: https://answers.splunk.com/answers/479464/how-to-index-evtx-files-in-splunk.html

Re: How can I upload an Administrative Events.evtx file?

lfedak_splunk — Tue, 08 Aug 2017 23:01:22 GMT

Hi @ddrillic, Following up on my previous answer after more research. @ppablo and @aaraneta helped me look through several other related inquiries and the documentation on Splunk Docs, and unfortunately it looks like the original evtx files can't be uploaded in this way as you requested due to the proprietary nature of the evtx files. You can read more from the answers to these questions here: https://answers.splunk.com/topics/evtx.html

We have a pretty active public Slack chat if you'd like to reach out there for more info or to see if an active user has found a workaround. You first have to request access through http://splk.it/slack. Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process may take a couple days), you can access Slack.com and ask for help in the #general channel.

Re: How can I upload an Administrative Events.evtx file?

woodcock — Wed, 09 Aug 2017 11:57:54 GMT

Decoding of evtx files must be done in context of the Windows server where it was generated and upload does not work. For a great explanation, see the answer by @inventsekar here (be sure to UpVote him):
https://answers.splunk.com/answers/479464/how-to-index-evtx-files-in-splunk.html

Re: How can I upload an Administrative Events.evtx file?

ddrillic — Sun, 13 Aug 2017 00:37:33 GMT

Very kind @woodcock

Re: How can I upload an Administrative Events.evtx file?

joesrepsolc — Fri, 13 Dec 2019 16:41:14 GMT

Just ran into this same issue, having trouble ingesting these .evtx logs (from Citrix application server). Also read thru the link woodcock provided (https://answers.splunk.com/answers/479464/how-to-index-evtx-files-in-splunk.html) and didn't see any clear answer.

Using a forwarder to monitor the file, also used the sourcetype=WinEventLog, after installing the Windows TA...but getting the same results as ddrillic.

Anyone got more info on how to ingest these logs? Thanks!

Joe

Re: How can I upload an Administrative Events.evtx file?

woodcock — Fri, 13 Dec 2019 17:03:17 GMT

I believe that @landen99 @alanden_splunk can shed some light on this.

Re: How can I upload an Administrative Events.evtx file?

landen99 — Sat, 14 Dec 2019 15:22:34 GMT

@joesrepsolc The solution appears fairly complicated, so clarity is not going to be expected when using Splunk to do it. I actually prefer the other answer by @tnesavich for the sake of clarity. But I expect it is much simpler to use the python method, not mentioned in those answers. Have you looked at python-evtx? https://github.com/williballenthin/python-evtx