In Splunk 4.x, Windows event logs are not read by Splunk's tailing processor. Instead, Splunk calls the Windows event log reader API on the server where the input is defined to read the files for it.
As a result, this constitutes an exception for the processing of configuration parameters in inputs.conf. These are not taken into account for inputs that monitor Windows event logs, and this is why the "index" setting specified in inputs.conf was not taken into account.
The solution is to set up a transformation that will change the value of "index" for these events later in event processing (in the parsing queue, to be accurate).
Here is a working example of this configuration:
indexes.conf:
[jbevtindex]
coldPath = $SPLUNK_DB/jbevtindex/colddb
homePath = $SPLUNK_DB/jbevtindex/db
thawedPath = $SPLUNK_DB/jbevtindex/thaweddb
inputs.conf:
[monitor://C:\Winevttest\Logs]
disabled = false
followTail = 0
sourcetype = jbsourcetype
Props.conf:
[source::C:\\Winevttest\\Logs\\*.evtx?]
TRANSFORMS-index = jbevtindex
Transforms.conf:
[jbevtindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = jbevtindex
So, as you can see, I want all .evt files in C:\WinEvtest\Logs\ to be called and have the
'jbevtindex' transform performed on them. That transform will write them to an index called 'jbevtindex'.
First, I set up the index, then I created the props entry and the transform. After that I set up the input and data came in, as expected, to the new index. I just did a search for index='jbevtindex' to validate that I saw events.
NOTE : This should no longer be necessary in 4.2, where inputs.conf parameters will be taken into account for EVT/EVTX file monitor inputs.
... View more
