Getting Data In

Are there limitations for a Splunk Indexer on Linux indexing imported Windows Event Logs?

thomas_porter
Explorer

I referenced a prior question on this regarding Linux Splunk server and Windows Event Logs: https://answers.splunk.com/answers/60343/linux-splunk-server-and-windows-event-logs.html

But this is more than 4 years old and I am hoping there might be a new app out there.

In addition to native network monitoring through forwarders, we expect to receive Windows event logs in the native format (.evtx) on DVD. My indexer is on a Centos box. Do I still have to go through the "wevtutil" command to convert to XML, or is there a Splunk app that will allow me to ingest those native event logs directly?

mgnzlz
Engager

HI,

No that was an old threat i just finished a project using this environment and everything is good, as a charm. So dont worry, all you will need is Splunk universal forwarders on windows machines.

Melvin Gonzalez
Security Consultant

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...