Getting Data In

Can Splunk index Windows Event Log(evt,evtx) files?

Ledio_Ago
Splunk Employee
Splunk Employee

Windows Server 2003, Windows XP and 2000 generate evt files, where Windows Vista, 2008 Server, Windows 7 generate evtx files. Can Splunk index these files just like any other text file?

1 Solution

bchen
Splunk Employee
Splunk Employee

Yes. The documentation on how to do this exists here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it. Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

View solution in original post

nvoitov
New Member

Splunk 1.4.1 x64 win32. Splunk can't index evt/evtx files due to binary...why???

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Please edit and clarify what version of Splunk you're talking about. Better yet, it sounds to me like you have a new question, so you should probably post new, rather than an answer to this one.

0 Karma

marcoscala
Builder

We've had several problems with this issue. Actually the Splunk docs is a bit misleading on this. The only guaranteed method to index Windows Event Logs events is to define a native input on a Splunk instance -could be a (light)forwarder too- on the same windows machine that generate the Events to index (add for instance a [WinEventLog:Application] stanza in inputs.conf).

As you can see from the last updated docs (http://www.splunk.com/base/Documentation/4.1.1/Admin/MonitorWindowsdata), indexing exported evt data has several limitations, due to the Microsoft proprietary way to generate those .evt files, which embed links to the DLLs used to generate them.

So take care when planning a Splunk deployment were there will be several evt files (or data) to index!

Marco Scala

bchen
Splunk Employee
Splunk Employee

Yes. The documentation on how to do this exists here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it. Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

ChrisG
Splunk Employee
Splunk Employee

Updated both docs URLs to permanent links

0 Karma

rturk
Builder

the_wolverine
Champion

the posted link is broken.

0 Karma

rmarietan
Engager

the link fricking doesn't work!!!!

0 Karma

jrodman
Splunk Employee
Splunk Employee

Well, they aren't text files at all, so the indexing is a bit different than a log file.

It's sensitive to running on windows, and for best results you want to index them on the host which produced them (for example to expand usernames and the like). For reasonable results the dlls which were involved in creating the events should be availble, which typically means indexing Vista-generated events on Vista, and so on.

The configuration necessary to index them should be just like a traditional text log, simply point a monitor input at the file. I haven't checked how the files are recognized -- by name, by content, or otherwise. Does anyone know?

ziegfried
Influencer

Yes, a Splunk 4 instance running on Windows can index those files. Just add a file monitoring data input and Splunk will decode the event log content. It doesn't work on *nix as far as I know, though.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...