Are there limitations for a Splunk Indexer on Linux indexing imported Windows Event Logs?

[thomas_porter]

I referenced a prior question on this regarding Linux Splunk server and Windows Event Logs: https://answers.splunk.com/answers/60343/linux-splunk-server-and-windows-event-logs.html

But this is more than 4 years old and I am hoping there might be a new app out there.

In addition to native network monitoring through forwarders, we expect to receive Windows event logs in the native format (.evtx) on DVD. My indexer is on a Centos box. Do I still have to go through the "wevtutil" command to convert to XML, or is there a Splunk app that will allow me to ingest those native event logs directly?

[mgnzlz]

HI,

No that was an old threat i just finished a project using this environment and everything is good, as a charm. So dont worry, all you will need is Splunk universal forwarders on windows machines.

Melvin Gonzalez
Security Consultant