Getting Data In

Splunk onboarding Custom Views from EventViewer

dc17
Explorer

Hello, 

I am trying to create a custom view (also via Xpath) from EventViewer and later insert it into Splunk via a "WinEventLog" and leveraging the Windows Addon.

Can it be done using "WinEventLog" or some other way in inputs.conf as it is for Application/Security/System? 
[WinEventLog://MyCustomLog]

As suggested here I tried this configuration but no logs were onboarded and it returned no error also in _internal logs. 

Has anyone found a custom solution for inserting these newly created custom views from the EventViewer to Splunk?

Thanks

Labels (4)
Tags (2)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@dc17  - You need to give full path like:

 

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
index = sysmon
sourcetype = WinEventLog:Sysmon

 

In my case, I can see a folder called Micrsoft > Windows > Sysmon folder. In which I can see Operational logs.

 

You need to give full path, instead of just MyCustomLog. Give full path, which you can find from Event Viewer.

 

I hope this helps!!!

VatsalJagani
SplunkTrust
SplunkTrust

@dc17 - Did the solution work for you?? If so, kindly consider accepting the answer for future Splunk users.

 

0 Karma

dc17
Explorer

Hi @VatsalJagani , 

Thanks for the reply, could you help me find the full path of the file/.evtx from the EventViewer? I could not find any reference from the EventViewer in my CustomViews of a full path where the Logs are stored. 

If I recollect this full path, I could perform some tests on the solution you kindly proposed to me, 

Thanks

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@dc17 - I'm not sure what logs you are trying to find in the EventViewer. Is it any known Application logs are you trying to find??

0 Karma

dc17
Explorer

Hi @VatsalJagani ,

I am not looking in any logs specifically because I need to create multiple Custom View and configure them with different Xpath queries.  So I am looking on an approach to monitor with WinEventLog these CustomViews.

In the photo an example of CustomView is "Test" folder.
But in the path C:\Windows\System32\winevt\Logs I could not find any reference to this "Test" CustomView.

dc17_1-1713283272111.png

To recap:
"Test" CustomView works fine in the EventViewer and it is updated live with the execution of my query. It contains all the events I am interested (not important which one). However I could not find any path connected to it, where the logs are stored and ready to be collected by a Splunk WinEventLog monitor.


Thanks,

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...