Getting Data In

Can Splunk index Windows Event Log(evt,evtx) files?

Ledio_Ago
Splunk Employee
Splunk Employee

Windows Server 2003, Windows XP and 2000 generate evt files, where Windows Vista, 2008 Server, Windows 7 generate evtx files. Can Splunk index these files just like any other text file?

1 Solution

bchen
Splunk Employee
Splunk Employee

Yes. The documentation on how to do this exists here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it. Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

View solution in original post

nvoitov
New Member

Splunk 1.4.1 x64 win32. Splunk can't index evt/evtx files due to binary...why???

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Please edit and clarify what version of Splunk you're talking about. Better yet, it sounds to me like you have a new question, so you should probably post new, rather than an answer to this one.

0 Karma

marcoscala
Builder

We've had several problems with this issue. Actually the Splunk docs is a bit misleading on this. The only guaranteed method to index Windows Event Logs events is to define a native input on a Splunk instance -could be a (light)forwarder too- on the same windows machine that generate the Events to index (add for instance a [WinEventLog:Application] stanza in inputs.conf).

As you can see from the last updated docs (http://www.splunk.com/base/Documentation/4.1.1/Admin/MonitorWindowsdata), indexing exported evt data has several limitations, due to the Microsoft proprietary way to generate those .evt files, which embed links to the DLLs used to generate them.

So take care when planning a Splunk deployment were there will be several evt files (or data) to index!

Marco Scala

bchen
Splunk Employee
Splunk Employee

Yes. The documentation on how to do this exists here:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it. Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

ChrisG
Splunk Employee
Splunk Employee

Updated both docs URLs to permanent links

0 Karma

rturk
Builder

the_wolverine
Champion

the posted link is broken.

0 Karma

rmarietan
Engager

the link fricking doesn't work!!!!

0 Karma

jrodman
Splunk Employee
Splunk Employee

Well, they aren't text files at all, so the indexing is a bit different than a log file.

It's sensitive to running on windows, and for best results you want to index them on the host which produced them (for example to expand usernames and the like). For reasonable results the dlls which were involved in creating the events should be availble, which typically means indexing Vista-generated events on Vista, and so on.

The configuration necessary to index them should be just like a traditional text log, simply point a monitor input at the file. I haven't checked how the files are recognized -- by name, by content, or otherwise. Does anyone know?

ziegfried
Influencer

Yes, a Splunk 4 instance running on Windows can index those files. Just add a file monitoring data input and Splunk will decode the event log content. It doesn't work on *nix as far as I know, though.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...