windows eventlog format and proprietary forwarder

[dominiquevocat]

Situation:
We use custom scripts to dump some eventlog events to textfiles and have a naming convention for the filenames that allows for custom scripts on the machines to report events.
We do this in order to get to splunk limited events from mobile clients based on windows.

Goal:
We would like to preprocess the text dump of the windows eventlogs to reformat the output into the fields used by the CIM and presumably the Splunk App for Windows. In order to do so it would be very valuable to know what fields should be named and what they shall contain.
Is there a field list that the Splunk App for Microsoft Windows uses for its views, reports etc? We would realy not want to deploy a forwarder on many thousands of enduser clients.

[lukejadamec]

The Splunk App for Windows uses events with the Windows eventlog sourcetypes, and it expects that the fields and contents of the fields are exactly the same as those generated by the Windows event logger.

From what I've seen, it might make more sense for you to collect the data you want, and in a format that the CIM uses (whatever CIM is), and then index that data in Splunk and write custom searches / dashboards that show the data you're interested in.

[dominiquevocat]

CIM -> Common Information Model
See http://docs.splunk.com/Documentation/CIM/3.0.1/User/HowtouseCIM