Getting Data In

Monitoring WEC .evtx files on another drive

I am after some help to debug why Splunk is not monitoring my external .evtx files.

Currently have the following: 

%SplunkHome%/etc/system/local/inputs.conf

 

[monitor://E:WINEVT\Logs\*]
disabled = 0
index = event_collector
sourcetype = WinEventLog

 


I have tried to debug this using Splunk list inputstatus and I can see that Splunk is reading the file but it is not getting indexed and I am getting output on my tcp stream with the indexer like this:

x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\

I have also tried: 

 

[WinEventLog://E:WINEVT\Logs\*]
disabled = 0
index = event_collector
sourcetype = WinEventLog

 

With no luck and no output on the TCP stream with theindexer.

Any tips on debugging or solutions much appreciated.

Labels (4)

SplunkTrust
SplunkTrust

To monitor Windows event logs, use the form WinEventLog://<name> where <name> is the type of event you want to monitor.  Do not specify a .evtx file as <name>.  Do not try to use monitor://*.evtx as Splunk cannot read an event log directly like that.

Your best option is to install a Windows add-on (along with a Universal Forwarder) from splunkbase on the system you want to monitor and the enable the desired inputs.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!