Getting Data In

Getting windows logs into splunk

gwcon
Path Finder

Hi,

I am very new to Splunk. I am looking for a way to get windows logs into Splunk.
I downloaded the Splunk forwarder but the issue is that this gives me gibberish logs.
Example: "--splunk-cooked-mode-v3--\x00\x00\x00\x00\x00\x00\x00\x00\"

I understood this is due to it being TCP but not being recognized as such and it needing to be configured in splunk itself as receiving from a Splunk fowarder ?
But this is not allowed with a free license ?

If anyone has a link explaining this, that would be a massive help, i would love to understand it way better.
I apologize up front if this is a really silly question and the answer is obvious.

0 Karma
1 Solution

natalielam
Explorer

Windows raw logs are binary files. Seems that your Splunk forwarder are not reading the logs properly. If you already installed the forwarder on your windows server, you can consider using the universal forwarder to forward the logs to your indexer: https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWindowseventlogdata#Use_a_universal_f...

It is also more convenient to use the add-on to set up log collection: https://splunkbase.splunk.com/app/742/

View solution in original post

natalielam
Explorer

Windows raw logs are binary files. Seems that your Splunk forwarder are not reading the logs properly. If you already installed the forwarder on your windows server, you can consider using the universal forwarder to forward the logs to your indexer: https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWindowseventlogdata#Use_a_universal_f...

It is also more convenient to use the add-on to set up log collection: https://splunkbase.splunk.com/app/742/

gwcon
Path Finder

Thanks for your reply, is this possible using the free edition of Splunk though ?
( i was convinced i got the cooked logs due to license, not due to config of forwarder in windows )

0 Karma

natalielam
Explorer

Yes definitely! I used the trial version for my testing and it works.

0 Karma

natalielam
Explorer

Noticed I put the wrong link to the windows add-on. Edited now. Cheers

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...