Is there any way to manually load a Windows event log into Splunk?

[Sam2]

Hello all,

is there any way to manually load a Windows Event log into Splunk? I have an EVT file from another machine, but want to load it into a local copy of Splunk for analysis. It is easy to add the event logs local Windows instance, and you can of course forward event logs from another machine, but is there any way to manually load in EVT logs??? A workaround is to convert the EVT files to CSV, but it would be good to do it without having to convert first???

Thanks!

[JOBSFLYER]

nice post click here

<a href="https://jobsflyer.com">find job</a>

[barakreeves]

I have run into this a few times where someone was needing to load an EVT file into Splunk just as you described. The problem is that EVT files are binary. You will need to write some code to convert that file to text (or CSV).

If these for one-off situations, such as doing forensics, here is a link I found to some code that will do the conversion; probably not what you were wanting to hear, but maybe others will in the community will have another solution. Here is the link to the code, written in C#: http://www.codeproject.com/Articles/15288/Parsing-event-log-evt-file. You may even try this utility: http://technet.microsoft.com/en-us/scriptcenter/dd919274

Hope this helps.

Happy Splunking!

--Barak

[Sam2]

OK, thanks for the pointers, but they seem to be a workaround. I'm not clear on what the actual issue is as Splunk must surely be able to understand the binary, as it can read the logs from the host machine for example?