https://community.splunk.com/t5/Splunk-Search/Windows-app-and-evtx-files/m-p/35930#M178532 <P>Does the account you are running Splunk under have sufficient privileges to access the Windows event logs in question?</P> Wed, 08 Sep 2010 20:19:46 GMT ftk 2010-09-08T20:19:46Z https://community.splunk.com/t5/Splunk-Search/Windows-app-and-evtx-files/m-p/35928#M178530 <P>So then what is the recommended method for ingesting evtx files from Windows 2008? Also, when I enable and configure the Windows App to monitor my event logs, on both 2003 and 2008 servers, nothing is getting ingested. I verified that my account has full control over the Splunk installation directory. I am now manually entering the Windows stanzas in the inputs.conf file.... </P> Tue, 24 Aug 2010 22:18:19 GMT https://community.splunk.com/t5/Splunk-Search/Windows-app-and-evtx-files/m-p/35928#M178530 gsawyer1 2010-08-24T22:18:19Z https://community.splunk.com/t5/Splunk-Search/Windows-app-and-evtx-files/m-p/35929#M178531 <P>Do you want to monitor the Event Logs, or do you want to load *.evtx files? The files are a byproduct of Windows Logging. If you want to log data, you should use Splunk's Windows Event Log monitoring, and forget about the files. Importing or monitoring the *.evtx files can be done, but is most useful if somehow you have copied them over away from the system where they are being generated.</P> Wed, 25 Aug 2010 04:57:01 GMT https://community.splunk.com/t5/Splunk-Search/Windows-app-and-evtx-files/m-p/35929#M178531 gkanapathy 2010-08-25T04:57:01Z https://community.splunk.com/t5/Splunk-Search/Windows-app-and-evtx-files/m-p/35930#M178532 <P>Does the account you are running Splunk under have sufficient privileges to access the Windows event logs in question?</P> Wed, 08 Sep 2010 20:19:46 GMT https://community.splunk.com/t5/Splunk-Search/Windows-app-and-evtx-files/m-p/35930#M178532 ftk 2010-09-08T20:19:46Z