Getting Data In

How to configure inputs.conf to forward PingFederate (.evtx) IIS logs in Splunk?

Path Finder

Hello Everyone,

I need to forward IIS logs from one of my hosts, so wrote inputs.conf in deployment server and deployed it to the host.

The normal IIS logs were forwarded, but the PingFederate IIS logs were not.

So i tried with this two thinks

disabled = 0 

disabled = 0 

disabled = 0 

disabled = 0 

Here, all logs come in except d:\PingFederate\PingIISAgent.evtx so I tried adding monitor instead of WinEventLog, but I received data that wasn't human readable.

Please can anyone help me on this? Where am I going wrong?


0 Karma

Splunk Employee
Splunk Employee

Is the file d:\PingFederate\PingIISAgent.evtx readable if you edit it?
If not then it is in proprietary format.

Sounds like you are trying to read events? You probably need to enable logging from the PING system. You may want to enable logging such as :
Administrator Audit Logging
Runtime Transaction Logging
Security Audit Logging
Server Logging
Which is documented here on Ping's website.

The logs are stored by default in the /pingfederate/log directory and end in *.log not evtx.

0 Karma


could you please provide sample logs of PingIISAgent.evtx

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>