Getting Data In

Adding custom logs from Event Viewer stanza

New Member

Anybody has experience with adding custom logs from Event Viewer to inputs.conf?

Is it enogh to put stanza:

[WinEventLogs://name of custom event logs same as in Event Viewer] or something else?

Thank you


Labels (3)
0 Karma


All of my customers have use the three standard event logs: Application, System, and Security.  One writes custom log entries to the Application log, which are then picked up by Splunk.

It may be possible to add a monitor like [WinEventLog://MyCustomLog].  Perhaps they best way to find out is to try it.  It can't hurt.

If this reply helps you, an upvote would be appreciated.
0 Karma


Hi @marcoatto 

As already described here -

EventViewer is a tool to see view the event logs in Windows they can not be directly ingested. [WinEventLog: is the way to ingest event logs to Splunk and you have to further filter these logs based on EventCode or other keys in to filter/customise what you want exactly. 

User Whitelist/blacklist settings to customise/filter them -


An upvote would be appreciated and Accept solution if it helps!

Tags (3)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!