Getting Data In

Fetching and Filtering Windows Application Logs on App/Eventlog base

tfechner
Path Finder

Hi,

 

we like to fetch application logs from a windows server  which are stored Windows Event Store in windows-application.

Windows Application Event Log Name : MSSQL_xxx
 Windows Event Log Source : XYX

I found:

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowseventlogdata#Specify_glo...

But is there a possibility to filter in the input-stanza like this

[WinEventLog://Application/MSSQL_xxx]
include = XYX
renderXml=1
sourcetype=XmlWinEventLog

 

Thanks.

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

No. The other field 🙂

PickleRick_0-1638863254440.png

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Yes, you can do it. You just need the name of the Log.

You browse in your Event Viewer to the log, click RMB on it, get into properties. And there you have field called "Full Name". That's what you need to put in your WinEventLog:// stanza.

Sometimes the name matches with the name displayed in the main EventViewer tree but sometimes it doesn't.

0 Karma

tfechner
Path Finder

so you meen like this:
[WinEventLog://C:\windows\System32\Winevt\Logs\MSSXXXXX.evtx]

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. The other field 🙂

PickleRick_0-1638863254440.png

 

tfechner
Path Finder

we will try this - will take some time as holiday season is reaching

0 Karma

tfechner
Path Finder

some more infos:

The path is not in "Windws Logs" (where Application, Systen Security ist located). The path is on the top-level with "Application and Services Logs", there is a new section "MSSQL_xxx". There you find the logs I need

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...