All Apps and Add-ons

Is there any way to manually load a Windows event log into Splunk?

Sam2
Explorer

Hello all,

is there any way to manually load a Windows Event log into Splunk? I have an EVT file from another machine, but want to load it into a local copy of Splunk for analysis. It is easy to add the event logs local Windows instance, and you can of course forward event logs from another machine, but is there any way to manually load in EVT logs??? A workaround is to convert the EVT files to CSV, but it would be good to do it without having to convert first???

Thanks!

JOBSFLYER
New Member

nice post click here

<a href="https://jobsflyer.com">find job</a>

0 Karma

barakreeves
Splunk Employee
Splunk Employee

I have run into this a few times where someone was needing to load an EVT file into Splunk just as you described. The problem is that EVT files are binary. You will need to write some code to convert that file to text (or CSV).

If these for one-off situations, such as doing forensics, here is a link I found to some code that will do the conversion; probably not what you were wanting to hear, but maybe others will in the community will have another solution. Here is the link to the code, written in C#: http://www.codeproject.com/Articles/15288/Parsing-event-log-evt-file. You may even try this utility: http://technet.microsoft.com/en-us/scriptcenter/dd919274

Hope this helps.

Happy Splunking!

--Barak

Sam2
Explorer

OK, thanks for the pointers, but they seem to be a workaround. I'm not clear on what the actual issue is as Splunk must surely be able to understand the binary, as it can read the logs from the host machine for example?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!