How do I route locally collected Windows event logs to a custom index?

[jbsplunk]

I am monitoring a folder which contains windows event log stored in .evt/.evtx files. I would like to have this data routed to an index other than "main". There are other files in this folder, and I only want .evt/.evtx files sent to this custom index. The files are contained in the directory C:\Winevttest\Logs\ and I want to route the events to the "jbevtindex" index.

I have tried to specify "index = jbevtindex" in the file monitor stanza for this input in inputs.conf, but this is not being taken into account. The events coming from this input are still being routed to the "main" index.

What configuration changes are necessary to specify this event routing??

[jbsplunk · Accepted solution]

In Splunk 4.x, Windows event logs are not read by Splunk's tailing processor. Instead, Splunk calls the Windows event log reader API on the server where the input is defined to read the files for it.

As a result, this constitutes an exception for the processing of configuration parameters in inputs.conf. These are not taken into account for inputs that monitor Windows event logs, and this is why the "index" setting specified in inputs.conf was not taken into account.

The solution is to set up a transformation that will change the value of "index" for these events later in event processing (in the parsing queue, to be accurate).

Here is a working example of this configuration:

indexes.conf:


[jbevtindex]
coldPath = $SPLUNK_DB/jbevtindex/colddb
homePath = $SPLUNK_DB/jbevtindex/db
thawedPath = $SPLUNK_DB/jbevtindex/thaweddb


inputs.conf:

[monitor://C:\Winevttest\Logs]
disabled = false
followTail = 0
sourcetype = jbsourcetype

Props.conf:

[source::C:\\Winevttest\\Logs\\*.evtx?]
TRANSFORMS-index = jbevtindex

Transforms.conf:

[jbevtindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = jbevtindex

So, as you can see, I want all .evt files in C:\WinEvtest\Logs\ to be called and have the 'jbevtindex' transform performed on them. That transform will write them to an index called 'jbevtindex'.

First, I set up the index, then I created the props entry and the transform. After that I set up the input and data came in, as expected, to the new index. I just did a search for index='jbevtindex' to validate that I saw events.

NOTE : This should no longer be necessary in 4.2, where inputs.conf parameters will be taken into account for EVT/EVTX file monitor inputs.