Getting Data In

Monitor Windows trace files

zivraf
Engager

I have a bunch of ETL files received from a customer I wish to analyze with splunk. I have added the folder containing all the files to splunk, but can't see any result when searching.
1. Does splunk support ETL format (binary) ?
2. Is there a way to track down files which are being indexed ?

regards,

Tags (1)

woodcock
Esteemed Legend

Something is going to have to decode it before it comes into splunk. Splunk has a way to facilitate this decoding automatically as part of the forwarding process but you must have access to the decoder tool as a command-line executable, for example:
https://msdn.microsoft.com/en-us/library/windows/hardware/ff543596(v=vs.85).aspx

The process for this is well documented here:
http://blogs.splunk.com/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles/

pwattssplunk
Splunk Employee
Splunk Employee

I'll answer the second question first, because it's easier. First you can always check the source field when searching against the target index. For file and directory monitors it will tell you which files provided the event.

As to the second, Splunk does not understand binary data. If you have a process that can translate the binary to something human readable, you can use that as a scripted input into splunk however.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...