How to index .EVTX file stored in a different location on a universal forwarder?

[bharathkumarnec]

HI All,

I would like to index .evtx file stored in a different location in my universal forwarder.

E:\Logs\Events\Fixed.Evtx

What are the approaches we have, to index these files?

I read some documentation but with few concerns, like it should not be written while read by splunk? if so, how can we achieve this?

Regards,
BK

[tiagofbmm]

Splunk doesn't constantly lock a file so you don't have to worry about that.

Just put a monitor stanza over the file. (Imagine how splunk would be useless monitoring log files if it blocked it from being written at all times)

[bharathkumarnec]

@tiagofbmm, Thanks for the details, did you try this anytime if so can i have the inputs how did it setup and what to consider in props & transforms on the indexer?

[tiagofbmm]

Yes I dos monitor stanzas to files that are continuously being written and without a problem.

The props and transforms you may need or not will depend on what your file contains, which I am not aware of course.

Take a look at this doc for starters and explore from there if a simple monitor doesn't solve it

http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Monitorfilesanddirectorieswithinputs.conf

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that