index exported evt / evtx files

[aweishe1]

Hi,

I am trying to index the exported evt / evtx files into splunk. I am using input.conf to monitor the directory on the same server where the evtx are exported (same server, same OS - Windows 2012 R2):

[monitor://D:\Splunk\*.evtx]
disabled = 0
sourcetype = WinEventLog:Security:Test
index = wineventlog

However, once the data got indexed, i tried to search and I found these:

ElfFile\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00

Help appreciated. Thanks!

[sudosplunk]

Indexing exported windows event logs have some limitations, due to Microsoft proprietary way to generate those .evt files. Windows event log (*.evt) files are in binary format. You cannot monitor them like you do a normal text file. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files.

Splunk Enterprise uses the following stanzas in inputs.conf to monitor the default Windows event logs:

# Windows platform specific input processor.
[WinEventLog://Application]
disabled = 0 
[WinEventLog://Security]
disabled = 0 
[WinEventLog://System]
disabled = 0 

From another answer -
workaround -
maybe, you can try to convert these files to text files or csv files and upload to splunk.
http://serverfault.com/questions/783708/convert-saved-evtx-files-to-text

[marycordova]

I think the problem with using those stanzas in inputs.conf is that it would monitor the local event files and not the exported ones...

[sparkspree]

this is a late response, but as someone going through a similar issue and for anyone who may come across this for help in the future, the issue with the stanza provided is that you are using the same sourcetype that Splunk uses when logs are directly forwarded and indexed from Windows host to the Splunk server. For your case you would want to change it to:

[monitor://D:\Splunk\*.evtx]
disabled = 0
sourcetype = preprocess-winevt
index = wineventlog