Getting Data In

Ingesting offline Windows Event logs from different systems

KP3
Engager

I am trying to use a Universal Forwarder to get a load of windows event logs that I need to analyse into Splunk. The event logs are from about 7 different systems and are all located on my local laptop in a folder. 

I have tried adding the folder into the inputs.conf file and setting the sourcetype to WinEventLog, but once the data is in, the individual events are not being extracted. Rather the entire file is being passed as one event and all I can see are the headers for each Event Log. 

Is someone able to help me with this please? 

I should probably state that I am using a Splunk Cloud instance and do not have a deployment server - I need to go straight from my laptop to the Splunk Cloud instance. 

Thanks

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

If I understood right you have those events on .evxt files? Is so you should create separate inputs.conf for those. There are couple of posts where this has explained

Key word seems to be sourcetype="preprocess-winevt".

If you have those files on linux there is some additional tools which your are needing to read/index correctly into splunk.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

If I understood right you have those events on .evxt files? Is so you should create separate inputs.conf for those. There are couple of posts where this has explained

Key word seems to be sourcetype="preprocess-winevt".

If you have those files on linux there is some additional tools which your are needing to read/index correctly into splunk.

r. Ismo

KP3
Engager

Thank you! That has worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...