Getting Data In

How to parse windows server logs with .conf file as well as with rex?

Mayuresh1516
New Member

I am using a windows server which is configured with forwarder.
Now I need all those logs on my desktop from where I want to monitor these logs.
Through indexers I will be passing those logs.
Please help me out for parsing such logs.
(Note: Latest version of windows server is being used)

0 Karma

woodcock
Esteemed Legend

Where is the forwarder configured to send the data (outputs.conf)?
You don't ever "need all those logs on your desktop"; they will go into an indexer which will do your bidding when you access it's data through your browser ("on your desktop").
The indexer will not "pass the logs"; the indexer is the final destination for them.
As far as "parsing", I assume you already have a "rex" command working so you can convert this to an automatic field extraction with props.conf:
http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...