All Apps and Add-ons

Is there any way to manually load a Windows event log into Splunk?

Explorer

Hello all,

is there any way to manually load a Windows Event log into Splunk? I have an EVT file from another machine, but want to load it into a local copy of Splunk for analysis. It is easy to add the event logs local Windows instance, and you can of course forward event logs from another machine, but is there any way to manually load in EVT logs??? A workaround is to convert the EVT files to CSV, but it would be good to do it without having to convert first???

Thanks!

New Member

nice post click here

<a href="https://jobsflyer.com">find job</a>

0 Karma

Splunk Employee
Splunk Employee

I have run into this a few times where someone was needing to load an EVT file into Splunk just as you described. The problem is that EVT files are binary. You will need to write some code to convert that file to text (or CSV).

If these for one-off situations, such as doing forensics, here is a link I found to some code that will do the conversion; probably not what you were wanting to hear, but maybe others will in the community will have another solution. Here is the link to the code, written in C#: http://www.codeproject.com/Articles/15288/Parsing-event-log-evt-file. You may even try this utility: http://technet.microsoft.com/en-us/scriptcenter/dd919274

Hope this helps.

Happy Splunking!

--Barak

Explorer

OK, thanks for the pointers, but they seem to be a workaround. I'm not clear on what the actual issue is as Splunk must surely be able to understand the binary, as it can read the logs from the host machine for example?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!