Adding custom logs from Event Viewer stanza

[marcoatto]

Anybody has experience with adding custom logs from Event Viewer to inputs.conf?

Is it enogh to put stanza:

[WinEventLogs://name of custom event logs same as in Event Viewer] or something else?

Thank you

[richgalloway]

All of my customers have use the three standard event logs: Application, System, and Security.  One writes custom log entries to the Application log, which are then picked up by Splunk.

It may be possible to add a monitor like [WinEventLog://MyCustomLog].  Perhaps they best way to find out is to try it.  It can't hurt.

[venkatasri]

Hi @marcoatto 

As already described here - https://community.splunk.com/t5/Getting-Data-In/Forwarding-windows-event-viewer-logs-to-Splunk/m-p/1...

EventViewer is a tool to see view the event logs in Windows they can not be directly ingested. [WinEventLog: is the way to ingest event logs to Splunk and you have to further filter these logs based on EventCode or other keys in to filter/customise what you want exactly. 

User Whitelist/blacklist settings to customise/filter them - https://docs.splunk.com/Documentation/Splunk/8.2.1/admin/Inputsconf#Event_Log_allow_list_and_deny_li...

---

An upvote would be appreciated and Accept solution if it helps!