How to index evtx files in Splunk?

[chanduira]

Hi Experts,

We have around 100 evtx files, and we want to index these files in Splunk and do analysis.

But when we configure it in inputs.conf both on the universal forwarder and Splunk itself, (from Splunk Web), it does not get indexed.

Kindly help with steps.

[inventsekar]

The documentation on how to do this exists here:
http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it.
Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

from another answer -
We've had several problems with this issue. Actually the Splunk docs is a bit misleading on this. The only guaranteed method to index Windows Event Logs events is to define a native input on a Splunk instance -could be a (light)forwarder too- on the same windows machine that generate the Events to index (add for instance a [WinEventLog:Application] stanza in inputs.conf).
As you can see from the last updated docs (http://www.splunk.com/base/Documentation/4.1.1/Admin/MonitorWindowsdata ), indexing exported evt data has several limitations, due to the Microsoft proprietary way to generate those .evt files, which embed links to the DLLs used to generate them.

So take care when planning a Splunk deployment were there will be several evt files (or data) to index!

more on this -
https://answers.splunk.com/answers/141/can-splunk-index-windows-event-log-evt-evtx-files.html

workaround -
maybe, you can try to convert these files to text files or csv files and upload to splunk.
http://serverfault.com/questions/783708/convert-saved-evtx-files-to-text