Ingesting offline Windows Event logs from different systems

[KP3]

I am trying to use a Universal Forwarder to get a load of windows event logs that I need to analyse into Splunk. The event logs are from about 7 different systems and are all located on my local laptop in a folder. 

I have tried adding the folder into the inputs.conf file and setting the sourcetype to WinEventLog, but once the data is in, the individual events are not being extracted. Rather the entire file is being passed as one event and all I can see are the headers for each Event Log. 

Is someone able to help me with this please? 

I should probably state that I am using a Splunk Cloud instance and do not have a deployment server - I need to go straight from my laptop to the Splunk Cloud instance. 

Thanks

[isoutamo · Accepted solution]

Hi

If I understood right you have those events on .evxt files? Is so you should create separate inputs.conf for those. There are couple of posts where this has explained

• https://invictus-ir.medium.com/importing-windows-event-log-files-into-splunk-9ae1beb0bea4
• https://www.cloud-response.com/2019/07/importing-windows-event-log-files-into.html

Key word seems to be sourcetype="preprocess-winevt".

If you have those files on linux there is some additional tools which your are needing to read/index correctly into splunk.

r. Ismo

[rvany]

A small update to these link (the former is a repost of the latter). The former link/document was moved to

• https://www.invictus-ir.com/news/importing-windows-event-log-files-into-splunk 

[KP3]

Thank you! That has worked.