Getting Data In

How to index evtx files in Splunk?

chanduira
Explorer

Hi Experts,

We have around 100 evtx files, and we want to index these files in Splunk and do analysis.

But when we configure it in inputs.conf both on the universal forwarder and Splunk itself, (from Splunk Web), it does not get indexed.

Kindly help with steps.

inventsekar
SplunkTrust
SplunkTrust

The documentation on how to do this exists here:
http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it.
Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

from another answer -
We've had several problems with this issue. Actually the Splunk docs is a bit misleading on this. The only guaranteed method to index Windows Event Logs events is to define a native input on a Splunk instance -could be a (light)forwarder too- on the same windows machine that generate the Events to index (add for instance a [WinEventLog:Application] stanza in inputs.conf).
As you can see from the last updated docs (http://www.splunk.com/base/Documentation/4.1.1/Admin/MonitorWindowsdata ), indexing exported evt data has several limitations, due to the Microsoft proprietary way to generate those .evt files, which embed links to the DLLs used to generate them.

So take care when planning a Splunk deployment were there will be several evt files (or data) to index!

more on this -
https://answers.splunk.com/answers/141/can-splunk-index-windows-event-log-evt-evtx-files.html

workaround -
maybe, you can try to convert these files to text files or csv files and upload to splunk.
http://serverfault.com/questions/783708/convert-saved-evtx-files-to-text

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...