Getting Data In

How to configure inputs.conf to monitor evtx files from a UNC path?

omerr
Explorer

Hi all,

I have a search head running on Windows operation system and I want to monitor evt & evtx (Windows Events-Logs files) from UNC path.

I have tried many ways to do it, but with no success - I saw the monitor when I open the Data Inputs on Splunk Web, but no events are coming into splunk.

I tried to edit inputs.conf file on $SPLUNK_HOME\etc\system\local with this:

[monitor://\\servername\share_path]
disable = false (or 0)
host = HOST
index = main

and

[monitor:\\servername\share_path]
disable = false (or 0)
host = HOST
index = main

I think it is important for many people so please help me to deal with this and make reference to others.

Thanks,

Omer.

Sarmbrister
Path Finder

After you began to index your evtx file did you data come in clean? I am currently having this issue and the data is coming across null for me. I can't figure out how to fix it.

0 Karma

woodcock
Esteemed Legend

This will work:

[monitor://servernameshare_path]
sourcetype = evtx_from_UNC
index = main

The problem may be that you did not set sourcetype. Also, setting host to the string HOST seems silly and it would be better for you to know the host of the machine that had the file so I removed that. Note that in the end, the stanza header should have 3 total slashes (2 forward and 1 back) after the colon like this: [monitor://\var\log/evtx\*.log] or whatever.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...