https://community.splunk.com/t5/Getting-Data-In/Loading-ETL-ETW-files-in-splunk/m-p/458567#M93948 <P>How can we load the saved ETL\ETW files in splunk.<BR /> The ETL file generated is for the providers created by me for my application and it can be viewed using Event Viewer by using "Open Saved Logs" menu.</P> Fri, 02 Nov 2018 06:01:18 GMT malti456 2018-11-02T06:01:18Z https://community.splunk.com/t5/Getting-Data-In/Loading-ETL-ETW-files-in-splunk/m-p/458567#M93948 <P>How can we load the saved ETL\ETW files in splunk.<BR /> The ETL file generated is for the providers created by me for my application and it can be viewed using Event Viewer by using "Open Saved Logs" menu.</P> Fri, 02 Nov 2018 06:01:18 GMT https://community.splunk.com/t5/Getting-Data-In/Loading-ETL-ETW-files-in-splunk/m-p/458567#M93948 malti456 2018-11-02T06:01:18Z https://community.splunk.com/t5/Getting-Data-In/Loading-ETL-ETW-files-in-splunk/m-p/458568#M93949 <P>Rather than trying to load an ETL file, you can instead collect data directly from the ETW Provider and then forward to Splunk. The NXLog Enterprise Edition im_etw module can do this (disclaimer: I'm involved in the project) and I've been able to use that module to forward my logs to Splunk in JSON format. I'm sure there are other ETW tools, I recently came across SilkETW but have not tried it with Splunk.</P> Fri, 22 Mar 2019 14:11:01 GMT https://community.splunk.com/t5/Getting-Data-In/Loading-ETL-ETW-files-in-splunk/m-p/458568#M93949 hcs0 2019-03-22T14:11:01Z