Getting Data In

How do I route locally collected Windows event logs to a custom index?

jbsplunk
Splunk Employee
Splunk Employee

I am monitoring a folder which contains windows event log stored in .evt/.evtx files. I would like to have this data routed to an index other than "main". There are other files in this folder, and I only want .evt/.evtx files sent to this custom index. The files are contained in the directory C:\Winevttest\Logs\ and I want to route the events to the "jbevtindex" index.

I have tried to specify "index = jbevtindex" in the file monitor stanza for this input in inputs.conf, but this is not being taken into account. The events coming from this input are still being routed to the "main" index.

What configuration changes are necessary to specify this event routing??

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

In Splunk 4.x, Windows event logs are not read by Splunk's tailing processor. Instead, Splunk calls the Windows event log reader API on the server where the input is defined to read the files for it.

As a result, this constitutes an exception for the processing of configuration parameters in inputs.conf. These are not taken into account for inputs that monitor Windows event logs, and this is why the "index" setting specified in inputs.conf was not taken into account.

The solution is to set up a transformation that will change the value of "index" for these events later in event processing (in the parsing queue, to be accurate).

Here is a working example of this configuration:

indexes.conf:


[jbevtindex]
coldPath = $SPLUNK_DB/jbevtindex/colddb
homePath = $SPLUNK_DB/jbevtindex/db
thawedPath = $SPLUNK_DB/jbevtindex/thaweddb


inputs.conf:

[monitor://C:\Winevttest\Logs]
disabled = false
followTail = 0
sourcetype = jbsourcetype

Props.conf:

[source::C:\\Winevttest\\Logs\\*.evtx?]
TRANSFORMS-index = jbevtindex

Transforms.conf:

[jbevtindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = jbevtindex

So, as you can see, I want all .evt files in C:\WinEvtest\Logs\ to be called and have the 'jbevtindex' transform performed on them. That transform will write them to an index called 'jbevtindex'.

First, I set up the index, then I created the props entry and the transform. After that I set up the input and data came in, as expected, to the new index. I just did a search for index='jbevtindex' to validate that I saw events.

NOTE : This should no longer be necessary in 4.2, where inputs.conf parameters will be taken into account for EVT/EVTX file monitor inputs.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

In Splunk 4.x, Windows event logs are not read by Splunk's tailing processor. Instead, Splunk calls the Windows event log reader API on the server where the input is defined to read the files for it.

As a result, this constitutes an exception for the processing of configuration parameters in inputs.conf. These are not taken into account for inputs that monitor Windows event logs, and this is why the "index" setting specified in inputs.conf was not taken into account.

The solution is to set up a transformation that will change the value of "index" for these events later in event processing (in the parsing queue, to be accurate).

Here is a working example of this configuration:

indexes.conf:


[jbevtindex]
coldPath = $SPLUNK_DB/jbevtindex/colddb
homePath = $SPLUNK_DB/jbevtindex/db
thawedPath = $SPLUNK_DB/jbevtindex/thaweddb


inputs.conf:

[monitor://C:\Winevttest\Logs]
disabled = false
followTail = 0
sourcetype = jbsourcetype

Props.conf:

[source::C:\\Winevttest\\Logs\\*.evtx?]
TRANSFORMS-index = jbevtindex

Transforms.conf:

[jbevtindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = jbevtindex

So, as you can see, I want all .evt files in C:\WinEvtest\Logs\ to be called and have the 'jbevtindex' transform performed on them. That transform will write them to an index called 'jbevtindex'.

First, I set up the index, then I created the props entry and the transform. After that I set up the input and data came in, as expected, to the new index. I just did a search for index='jbevtindex' to validate that I saw events.

NOTE : This should no longer be necessary in 4.2, where inputs.conf parameters will be taken into account for EVT/EVTX file monitor inputs.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...