I am after some help to debug why Splunk is not monitoring my external .evtx files. Currently have the following:  %SplunkHome%/etc/system/local/inputs.conf   [monitor://E:WINEVT\Logs\*] disabled = 0 index = event_collector sourcetype = WinEventLog   I have tried to debug this using Splunk list inputstatus and I can see that Splunk is reading the file but it is not getting indexed and I am getting output on my tcp stream with the indexer like this: x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ I have also tried:    [WinEventLog://E:WINEVT\Logs\*] disabled = 0 index = event_collector sourcetype = WinEventLog   With no luck and no output on the TCP stream with theindexer. Any tips on debugging or solutions much appreciated. ... View more

I would like some advice on what is the best way to implement the following solution. I would like to get netflow data to Splunk Enterprise running on Windows server that is coming from cisco devices using netflow-exporter. The problem is windows has a winpcap vulnerability and I would rather not use any add ons that contain that wpcap.dll. My solution would be to set up a Linux server to use the universal forwarder to ingest the netflow data and parse that to Splunk enterprise on Windows without any add ons. I am having a hard timevdetermining if this is possible or will I require a TA on Splunk enterprise? ... View more