Getting Data In

Windows Event Logs and Non Standard Importing

smvalois
Explorer

Morning,

We run AD in our environment and the Windows server team does not wish to allow for the use of WMI calls and a service account. They already have a tool called "Event Reporter" which will package windows logs and send them Syslog. Do you know of a way to parse Non standard Windows logs? I either have to figure this out, or remap all the fields by hand using the built in field extractor.

Thank you

Tags (2)
0 Karma

mazurmateusz
Engager

follow up. How you solve your problem?

0 Karma

ltrand
Contributor

You can use the props & transforms.conf files to dictate how to parse this automatically.

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

0 Karma

smvalois
Explorer

I know that you can over ride parsers in other products like LogRhyhtm and ArcSight, I am mostly looking to see if i can force a parse on a source, if I know the data type.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...