topic Re: Reading WindowsEvent logs from UNC path in Getting Data In

Reading WindowsEvent logs from UNC path

AndreasLP — Sat, 08 Sep 2012 21:59:52 GMT

Hi,

I have some issues with setting up Splunk to read a WindwsEvent file stored on a network share. It seems like the setup is fine, but no files shows up in Splunk and nothing is indexed.

From the exact same destination I'm able to read windows update logs without any problems, so it shouldn't be any problems with the credentials. All files have the same permissions.

Since this is my first tme setting up Splunk I hope i have made some simple misstake which is easily fixed.

Re: Reading WindowsEvent logs from UNC path

neklov_splunk — Sat, 08 Sep 2012 22:12:12 GMT

Have you taken a look here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorwindowsdata

Re: Reading WindowsEvent logs from UNC path

AndreasLP — Sat, 08 Sep 2012 22:43:10 GMT

Unfortunately that access path is restricted, I have only the UNC path to work with 😞

Re: Reading WindowsEvent logs from UNC path

neklov_splunk — Sat, 08 Sep 2012 22:49:31 GMT

What access path is restricted?

Re: Reading WindowsEvent logs from UNC path

AndreasLP — Sat, 08 Sep 2012 22:55:06 GMT

All access to the server is firewalled except for the network share where the logs are put as evtx files. I'm not allowed to connect directly to the originator. The files on the share are file dumps from the event log.

Re: Reading WindowsEvent logs from UNC path

MarioM — Mon, 28 Sep 2020 12:24:23 GMT

what neklov_splunk was pointing to is the this part of the doc:
http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/MonitorWindowsdata#Index_exported_event_log_.28.evt_or_.evtx.29_files

Re: Reading WindowsEvent logs from UNC path

MarioM — Sun, 09 Sep 2012 09:14:40 GMT

Adding to the above the splunk which has access to the unc path need to be installed on Windows Vista, 7 or Server 2008/2008 R2 to read .evtx

Re: Reading WindowsEvent logs from UNC path

AndreasLP — Mon, 10 Sep 2012 12:50:26 GMT

It turned out I was restricted by a very exotic Group Policy Setting. When that was corrected, everything works fine.

Thanks for all the answers and quick help!