Getting Data In

How to index .EVTX file stored in a different location on a universal forwarder?

Communicator

HI All,

I would like to index .evtx file stored in a different location in my universal forwarder.

E:\Logs\Events\Fixed.Evtx

What are the approaches we have, to index these files?

I read some documentation but with few concerns, like it should not be written while read by splunk? if so, how can we achieve this?

Regards,
BK

0 Karma

Influencer

Splunk doesn't constantly lock a file so you don't have to worry about that.

Just put a monitor stanza over the file. (Imagine how splunk would be useless monitoring log files if it blocked it from being written at all times)

0 Karma

Communicator

@tiagofbmm, Thanks for the details, did you try this anytime if so can i have the inputs how did it setup and what to consider in props & transforms on the indexer?

0 Karma

Influencer

Yes I dos monitor stanzas to files that are continuously being written and without a problem.

The props and transforms you may need or not will depend on what your file contains, which I am not aware of course.

Take a look at this doc for starters and explore from there if a simple monitor doesn't solve it

http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Monitorfilesanddirectorieswithinputs.conf

0 Karma

Influencer

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

0 Karma