Getting Data In

How to index evtx files in Splunk?

chanduira
Explorer

Hi Experts,

We have around 100 evtx files, and we want to index these files in Splunk and do analysis.

But when we configure it in inputs.conf both on the universal forwarder and Splunk itself, (from Splunk Web), it does not get indexed.

Kindly help with steps.

inventsekar
Ultra Champion

The documentation on how to do this exists here:
http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it.
Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

from another answer -
We've had several problems with this issue. Actually the Splunk docs is a bit misleading on this. The only guaranteed method to index Windows Event Logs events is to define a native input on a Splunk instance -could be a (light)forwarder too- on the same windows machine that generate the Events to index (add for instance a [WinEventLog:Application] stanza in inputs.conf).
As you can see from the last updated docs (http://www.splunk.com/base/Documentation/4.1.1/Admin/MonitorWindowsdata ), indexing exported evt data has several limitations, due to the Microsoft proprietary way to generate those .evt files, which embed links to the DLLs used to generate them.

So take care when planning a Splunk deployment were there will be several evt files (or data) to index!

more on this -
https://answers.splunk.com/answers/141/can-splunk-index-windows-event-log-evt-evtx-files.html

workaround -
maybe, you can try to convert these files to text files or csv files and upload to splunk.
http://serverfault.com/questions/783708/convert-saved-evtx-files-to-text

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...