Windows eventid csv file for Splunk lookup?

[maverick]

Does anyone happen to have (or know where I can find) a csv file that contains the various Windows security eventids and their matching humanly-readable meanings so I can use it as my lookup file?

If not, then where is the best page on msdn.com to look for the listing myself so I can compile one?

If I make one myself, then I will share it on splunkbase as an add-on.

Therefore, you can think of it as you are helping me to help you. 🙂

[ftk · Accepted solution]

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx

Almost CSV format already!

[splk]

https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/Lookups

[muebel · Accepted solution]

http://pastie.org/1066138.txt

Link to CSV mapping eventcode to event description^

[maverick]

WOW! Thanks! I appreciate it!

[djemodjenai]

This pastie link may be down.

[ftk · Accepted solution]

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx

Almost CSV format already!

[maverick]

Thanks! This will help.