Getting Data In

How to capture Windows evtx files

Path Finder

A customer has asked me to pick up the following logs:


I am trying to figure out how to obtain those and have looked at a number of posts, but I'm not seeing what I'd like to do. Is the following possible? I want to create an inputs file as follows:

index = Winevt
sourceType = Winevt:Application
disabled = 0 
index = Winevt
sourceType = Winevt:Security
disabled = 0 
index = Winevt
sourceType = Winevt:System
disabled = 0 

But how does it know where to go for the actual files I want picked up?

Do I need to put in a full path to the logs (for instance d:/windows/events..../application.evtx)?

Any assist would be very helpful.

0 Karma

Splunk Employee
Splunk Employee

See link below for walkthough

Key is to monitor evtx files using the special preprocess-event sourcetype on a windows instance of Splunk.

1. Copy evtx to spare windows server
2. Load as many services as possible for known content (IE if evtx for AD load AD etc)
3. Install Splunk
4. Monitor directory with evtx files

I did this on a Windows EC2 instance successfully, stopped Splunk on Windows EC2 instance and then copied the following over to my test instance of Splunk on my Mac to faster / more direct access to the parsed evtx:


Splunk knows where to find the event logs. Set the stanza name to WinEventLog://Application, WinEventLog://Security, or WinEventLog:System and Splunk will do the rest.

BTW, the conventional name for the Windows event sourcetypes is WinEventLog:*. Other names are allowed, but apps that process Windows events may not work without modification.

If this reply helps you, an upvote would be appreciated.


So Splunk doesn't monitor the files but the event log channels itself. You don't want the full path but use the built monitors like you have listed. Documentation on these are available here: The add-on Splunk_TA_windows also has an inputs as well as other useful parsing for these logs you can use. That is available here:

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>