All Apps and Add-ons

Index-time field extraction for Windows eventlog

yuwtennis
Communicator

Hi !

I am considering to implement following index-time field extraction for
exported Windows security eventlog.

Substitute computer name as "test".

However, I am bit confused with the steps you need to take.
I beleieve that you need to set the source type of Windows eventlog
as preprosess-winevt when you input the log manually . ( I have an environemnt where you cannot use neither forwarder nor WMI)

I would like to advice for how to set up props.conf and transforms.conf.
Any advice is appreciated!

Thanks,
Yu

0 Karma
1 Solution

lukejadamec
Super Champion

You can copy the logs to a different machine, and then indexing them with a directory monitor, then you can use the monitor source for your index time extraction. The machine that monitors the copied log files needs to run the same version of Windows, for example: W2K8 logs cannot be read by a W2k3 server.

View solution in original post

lukejadamec
Super Champion

You can copy the logs to a different machine, and then indexing them with a directory monitor, then you can use the monitor source for your index time extraction. The machine that monitors the copied log files needs to run the same version of Windows, for example: W2K8 logs cannot be read by a W2k3 server.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...