Getting Data In

Adding custom logs from Event Viewer stanza

New Member

Anybody has experience with adding custom logs from Event Viewer to inputs.conf?

Is it enogh to put stanza:

[WinEventLogs://name of custom event logs same as in Event Viewer] or something else?

Thank you


Labels (3)
0 Karma


All of my customers have use the three standard event logs: Application, System, and Security.  One writes custom log entries to the Application log, which are then picked up by Splunk.

It may be possible to add a monitor like [WinEventLog://MyCustomLog].  Perhaps they best way to find out is to try it.  It can't hurt.

If this reply helps you, an upvote would be appreciated.
0 Karma


Hi @marcoatto 

As already described here -

EventViewer is a tool to see view the event logs in Windows they can not be directly ingested. [WinEventLog: is the way to ingest event logs to Splunk and you have to further filter these logs based on EventCode or other keys in to filter/customise what you want exactly. 

User Whitelist/blacklist settings to customise/filter them -


An upvote would be appreciated and Accept solution if it helps!

Tags (3)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.