Getting Data In

Can the Splunk Add-on for Sysmon work with a file input on a Heavy Forwarder ?

whardy
New Member

I would like to be able to configure the Splunk Add-on for Sysmon to ingest logs from a file instead of the Windows Event Log directly. The default input.conf in the Splunk Add-on for Sysmon App contains the following: 

[WinEventLog://WEC-Sysmon]
disabled = true
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype = XmlWinEventLog:WEC-Sysmon
host = WinEventLogForwardHost

I tried to override the input like so:

[monitor:///path/to/my_file/filename.log]
disabled = false
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype = XmlWinEventLog:WEC-Sysmon
host = WinEventLogForwardHost

Unfortunately, it doesn't work and no logs appear to be sent by the Heavy Forwarder to my Indexer. the file I am using contains Windows Logs in a standard Windows Event Log XML format (1 per line). I want to be CIM compliant with my Sysmon logs but I cannot use a WinEventLog:// input, I have to use a file input.

Labels (3)
0 Karma

wmazur-splunk
Splunk Employee
Splunk Employee

Probably it won't work. 

Try "regular" approach: Settings -> Data Input -> Upload files from computer, select `XmlWinEventLog:WEC-Sysmon` as a source type in second step (Set Source Type).

You can select source type from any installed add-on. Splunk will try to digest the input according to the expected source type.

 

0 Karma

whardy
New Member

This is not an option since the file is constantly being updated with new logs and manually uploading the file is not an option.

0 Karma

wmazur-splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...