Getting Data In

Ingesting offline Windows Event logs from different systems

KP3
Engager

I am trying to use a Universal Forwarder to get a load of windows event logs that I need to analyse into Splunk. The event logs are from about 7 different systems and are all located on my local laptop in a folder. 

I have tried adding the folder into the inputs.conf file and setting the sourcetype to WinEventLog, but once the data is in, the individual events are not being extracted. Rather the entire file is being passed as one event and all I can see are the headers for each Event Log. 

Is someone able to help me with this please? 

I should probably state that I am using a Splunk Cloud instance and do not have a deployment server - I need to go straight from my laptop to the Splunk Cloud instance. 

Thanks

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

If I understood right you have those events on .evxt files? Is so you should create separate inputs.conf for those. There are couple of posts where this has explained

Key word seems to be sourcetype="preprocess-winevt".

If you have those files on linux there is some additional tools which your are needing to read/index correctly into splunk.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

If I understood right you have those events on .evxt files? Is so you should create separate inputs.conf for those. There are couple of posts where this has explained

Key word seems to be sourcetype="preprocess-winevt".

If you have those files on linux there is some additional tools which your are needing to read/index correctly into splunk.

r. Ismo

KP3
Engager

Thank you! That has worked.

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...