Getting Data In

Can Windows Events and pcap files can be loaded into Splunk


Does anyone know if Splunk can import Microsoft Event files or cap, pacp, pcapng files from programs like Wireshark, Network Minder etc?

I’m not a Senior Engineer but I thought cap, pcap and pcapng have been an industry standard file format for 25 years. Same with Microsoft event logs. Is she correct? Splunk doesn’t understand Microsoft event files or Wireshark pcap files?

Is there anyone at Splunk who has worked with Microsoft Event files or pcap files who might have a sample? Our Splunk Engineer wants us to submit sample files but I don’t have any sanitized files to give her. I’m hoping someone at Splunk can help me out.


Tags (2)
0 Karma

Path Finder

A little late in responding but a app called stream indexes pcaps!!

0 Karma


Is there any Splunk documention I can have our Splunk Senior Engineer read? Or do you know if anyone at Splunk knows about this I can refer our Splunk Senior Engineer to?

0 Karma

Splunk Employee
Splunk Employee

Yes, all those things can be ingested into Splunk. The Microsoft Event Logs are parsed by Splunk core. The pcaps are more complex and that isn't a fully solved problem, but there are many ways you can do that on your own or with future enhancements that are likely being worked on today.

I should add that the Sourcefire eStreamer Splunk app does contain pcap data as sent from Sourcefire, but I don't think it is designed to read libpcap format files directly.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...