Getting Data In

WIndows Events get \x00\ in agent Splunk Forwarder

zksvc
Contributor

Hi Everyone,

i got error since i try install new agent in new server using SplunkForwarder. 

For inputs.conf i use like this 

 

[WinEventLog://Security]
disabled = 0
index = windows
sourcetype = Wineventlog:Security

[WinEventLog://System]
disabled = 0
index = windows
sourcetype = Wineventlog:System

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled = 0
index = windows
sourcetype = WinEventLog:PowerShell

 

And the preview is like this in source = C:\Windows\System32\winevt\Logs\Microsoft-Windows-WFP%4Operational.evtx 

zksvc_0-1739171786682.png

This is not my first time to ingest windows, but this error just happen to me right now. And i confuse how to solved it.

 

0 Karma
1 Solution

zksvc
Contributor

My bad, in this env my friend setting different inputs.conf and it from .evtx and it cannot readable in splunk without some setting. Sorry guys

View solution in original post

0 Karma

dataisbeautiful
Communicator

Hi @zksvc 

Looks like a binary file was read there.

Have you followed the steps here https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/MonitorWindowseventlogdata ?

0 Karma

zksvc
Contributor

My bad, in this env my friend setting different inputs.conf and it from .evtx and it cannot readable in splunk without some setting. Sorry guys

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...