Getting Data In

How to ingest archived event logs?

aikn061
Explorer

Hi there,  

So we have one of our event logs set to archive.  But there were some files that are already there before we started ingesting this log.  

So if I want to bring these logs in to splunk how do you do it?  I understand in this case UF and WI are only options.  

So I did deploy the below with deployment server and restarted deploy-server.  But this log did not make it to splunk.  Any ideas what could be the problem?  or any other way I can bring in exported/archived event logs in to splunk?

 

[monitor://C:\windows\system32\winent\logs\Archive_log.evtx]
disabled = 0
index=idx

Labels (1)
0 Karma

shivanshu1593
Builder

Splunk docs specify that you cannot monitor Windows event log (*.evt) files with a [monitor://] stanza as they are in binary format. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files.

Not really sure if you can monitor the archived logs, but maybe try modifying the following stanza from the docs for the archived logs and see if it helps. 

Use the Full Name log property in Event Viewer to specify complex Event Log channel names properly
You can use the Full Name Event Log property in Event Viewer to ensure that you specify the correct Event Log channel in an inputs.conf stanza.

For example, to monitor the Task Scheduler application log, Microsoft-Windows-TaskScheduler-Operational, do the following steps:

Open Event Viewer.
Expand Applications and Services Logs > Microsoft > Windows > TaskScheduler.
Right-click Operational and select Properties.
In the dialog that appears, copy the text in the Full Name field.
Append this text into the WinEventLog:// stanza of inputs.conf as in the following example:
[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
disabled = 0



More information on the same: 
https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/MonitorWindowseventlogdata

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

2MuchC0ff33
Explorer

Interesting question, @aikn061,

I read the document you hyperlinked in your post and did some further poking myself.

Have you tried directly calling the Windows event log APIs from a script and sending the logs to Splunk via the HTTP Event Collector (HEC)?

If not, here are the additional articles I looked at:

Let me know how you get on; I'd love to hear your thoughts.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...