Can the Splunk Add-on for Sysmon work with a file input on a Heavy Forwarder ?

[whardy]

I would like to be able to configure the Splunk Add-on for Sysmon to ingest logs from a file instead of the Windows Event Log directly. The default input.conf in the Splunk Add-on for Sysmon App contains the following: 

[WinEventLog://WEC-Sysmon]
disabled = true
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype = XmlWinEventLog:WEC-Sysmon
host = WinEventLogForwardHost

I tried to override the input like so:

[monitor:///path/to/my_file/filename.log]
disabled = false
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype = XmlWinEventLog:WEC-Sysmon
host = WinEventLogForwardHost

Unfortunately, it doesn't work and no logs appear to be sent by the Heavy Forwarder to my Indexer. the file I am using contains Windows Logs in a standard Windows Event Log XML format (1 per line). I want to be CIM compliant with my Sysmon logs but I cannot use a WinEventLog:// input, I have to use a file input.

[wmazur-splunk]

Probably it won't work. 

Try "regular" approach: Settings -> Data Input -> Upload files from computer, select `XmlWinEventLog:WEC-Sysmon` as a source type in second step (Set Source Type).

You can select source type from any installed add-on. Splunk will try to digest the input according to the expected source type.

[whardy]

This is not an option since the file is constantly being updated with new logs and manually uploading the file is not an option.

[wmazur-splunk]

Splunk covers that as well. Select "Monitor" instead of "Upload".

https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/MonitorfilesanddirectorieswithSplunkWeb.

https://youtu.be/b2Kztj03hBc