topic Adding custom logs from Event Viewer stanza in Getting Data In

Adding custom logs from Event Viewer stanza

marcoatto — Wed, 07 Jul 2021 19:57:15 GMT

Anybody has experience with adding custom logs from Event Viewer to inputs.conf?

Is it enogh to put stanza:

[WinEventLogs://name of custom event logs same as in Event Viewer] or something else?

Thank you

Re: Adding custom logs from Event Viewer stanza

venkatasri — Wed, 07 Jul 2021 23:45:04 GMT

Hi @marcoatto

As already described here - https://community.splunk.com/t5/Getting-Data-In/Forwarding-windows-event-viewer-logs-to-Splunk/m-p/124085

EventViewer is a tool to see view the event logs in Windows they can not be directly ingested. [WinEventLog: is the way to ingest event logs to Splunk and you have to further filter these logs based on EventCode or other keys in to filter/customise what you want exactly.

User Whitelist/blacklist settings to customise/filter them - https://docs.splunk.com/Documentation/Splunk/8.2.1/admin/Inputsconf#Event_Log_allow_list_and_deny_list_formats

---

An upvote would be appreciated and Accept solution if it helps!

Re: Adding custom logs from Event Viewer stanza

richgalloway — Thu, 08 Jul 2021 12:58:37 GMT

All of my customers have use the three standard event logs: Application, System, and Security. One writes custom log entries to the Application log, which are then picked up by Splunk.

It may be possible to add a monitor like [WinEventLog://MyCustomLog]. Perhaps they best way to find out is to try it. It can't hurt.