Getting Data In

How to capture Windows evtx files

nls7010
Path Finder

A customer has asked me to pick up the following logs:

%SystemRoot%\System32\Winevt\Logs\Application.evtx
%SystemRoot%\System32\Winevt\Logs\Security.evtx
%SystemRoot%\System32\Winevt\Logs\System.evtx

I am trying to figure out how to obtain those and have looked at a number of posts, but I'm not seeing what I'd like to do. Is the following possible? I want to create an inputs file as follows:

[WinEventLog://Application]
index = Winevt
sourceType = Winevt:Application
disabled = 0 
[WinEventLog://Security]
index = Winevt
sourceType = Winevt:Security
disabled = 0 
[WinEventLog://System]
index = Winevt
sourceType = Winevt:System
disabled = 0 

But how does it know where to go for the actual files I want picked up?

Do I need to put in a full path to the logs (for instance d:/windows/events..../application.evtx)?

Any assist would be very helpful.

0 Karma

tnesavich_splun
Splunk Employee
Splunk Employee

See link below for walkthough
https://www.cloud-response.com/2019/07/importing-windows-event-log-files-into.html

Key is to monitor evtx files using the special preprocess-event sourcetype on a windows instance of Splunk.

Takeaways:
1. Copy evtx to spare windows server
2. Load as many services as possible for known content (IE if evtx for AD load AD etc)
3. Install Splunk
4. Monitor directory with evtx files

NOTE
I did this on a Windows EC2 instance successfully, stopped Splunk on Windows EC2 instance and then copied the following over to my test instance of Splunk on my Mac to faster / more direct access to the parsed evtx:
SPLUNK_HOME/var/lib/splunk/wineventlog
SPLUNK_HOME/var/lib/splunk/wineventlog.dat

richgalloway
SplunkTrust
SplunkTrust

Splunk knows where to find the event logs. Set the stanza name to WinEventLog://Application, WinEventLog://Security, or WinEventLog:System and Splunk will do the rest.

BTW, the conventional name for the Windows event sourcetypes is WinEventLog:*. Other names are allowed, but apps that process Windows events may not work without modification.

---
If this reply helps you, Karma would be appreciated.

mdsnmss
SplunkTrust
SplunkTrust

So Splunk doesn't monitor the files but the event log channels itself. You don't want the full path but use the built monitors like you have listed. Documentation on these are available here: https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Inputsconf#Windows_Event_Log_Monitor. The add-on Splunk_TA_windows also has an inputs as well as other useful parsing for these logs you can use. That is available here: https://splunkbase.splunk.com/app/742/.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...