Getting Data In
Highlighted

Can Splunk index Windows Event Log(evt,evtx) files?

Splunk Employee
Splunk Employee

Windows Server 2003, Windows XP and 2000 generate evt files, where Windows Vista, 2008 Server, Windows 7 generate evtx files. Can Splunk index these files just like any other text file?

Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Influencer

Yes, a Splunk 4 instance running on Windows can index those files. Just add a file monitoring data input and Splunk will decode the event log content. It doesn't work on *nix as far as I know, though.

Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Splunk Employee
Splunk Employee

Well, they aren't text files at all, so the indexing is a bit different than a log file.

It's sensitive to running on windows, and for best results you want to index them on the host which produced them (for example to expand usernames and the like). For reasonable results the dlls which were involved in creating the events should be availble, which typically means indexing Vista-generated events on Vista, and so on.

The configuration necessary to index them should be just like a traditional text log, simply point a monitor input at the file. I haven't checked how the files are recognized -- by name, by content, or otherwise. Does anyone know?

Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Splunk Employee
Splunk Employee

Yes. The documentation on how to do this exists here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it. Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

View solution in original post

Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Champion

the posted link is broken.

0 Karma
Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Engager

the link fricking doesn't work!!!!

0 Karma
Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Builder
Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Splunk Employee
Splunk Employee

Updated both docs URLs to permanent links

0 Karma
Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

Builder

We've had several problems with this issue. Actually the Splunk docs is a bit misleading on this. The only guaranteed method to index Windows Event Logs events is to define a native input on a Splunk instance -could be a (light)forwarder too- on the same windows machine that generate the Events to index (add for instance a [WinEventLog:Application] stanza in inputs.conf).

As you can see from the last updated docs (http://www.splunk.com/base/Documentation/4.1.1/Admin/MonitorWindowsdata), indexing exported evt data has several limitations, due to the Microsoft proprietary way to generate those .evt files, which embed links to the DLLs used to generate them.

So take care when planning a Splunk deployment were there will be several evt files (or data) to index!

Marco Scala

Highlighted

Re: Can Splunk index Windows Event Log(evt,evtx) files?

New Member

Splunk 1.4.1 x64 win32. Splunk can't index evt/evtx files due to binary...why???

0 Karma