Splunk Metadata for Windows EVTX Files

[sdwilkerson]

I am at a site where we are using a Splunk Forwarder to mount a DFS share and read EVTX Archive Files placed there by another entity.

The Splunk Forwarder is 4.1.5 x64 on Windows 2008. The Splunk Forwarder is also a Search Head federating search requests to the same indexer where it is sending these evtx logs (not that it should make a difference).

There are no problems with the reads/parse of the EVTX files; however, we appear to have a problem with modifying the Splunk Metadata for these events.

Ideally, we would customize the Index field. This appears to not work.

In the inputs.conf I have tried setting the index and the sourcetype but no matter what I enter, here is where the events show up:

• index=main
• sourcetype=WinEventLog:Security

I have also tried using props/transforms to set the Metatdata DEST_KEY on both the Forwarder and the Indexer (several ways). No matter, what I select or set, it appears that I can have no impact on the index or sourcetype.

My thought is that since the evtx files are binary, that a separate process handles these that isn't accepting modification.

Is this crazy or some limitation of the (evt|evtx) parser?

Sean

[Ledio_Ago · Accepted solution]

Sean, that is true. You can't set index, source or any other metadata for ".evt(x)" type inputs. There is a special process that does the parsing, instead of the tailing processor, and it doesn't support setting those type of metadata.

This has been fixed and will be shipped with next major version of Splunk, 4.2

Thanks, Ledio

[malmoore]

Done. (from the docs team)

[Ledio_Ago]

That's a good point. I will send this to the docs team and them updated.

Thanks!

[sdwilkerson]

Ledio,
Much appreciated. I thought I was going nuts. Wish the docs had warned me.
Sean