I referenced a prior question on this regarding Linux Splunk server and Windows Event Logs: https://answers.splunk.com/answers/60343/linux-splunk-server-and-windows-event-logs.html
But this is more than 4 years old and I am hoping there might be a new app out there.
In addition to native network monitoring through forwarders, we expect to receive Windows event logs in the native format (.evtx) on DVD. My indexer is on a Centos box. Do I still have to go through the "wevtutil" command to convert to XML, or is there a Splunk app that will allow me to ingest those native event logs directly?
HI,
No that was an old threat i just finished a project using this environment and everything is good, as a charm. So dont worry, all you will need is Splunk universal forwarders on windows machines.
Melvin Gonzalez
Security Consultant