Getting Data In

Windows Event logs in syslog format

wcgrech
New Member

All our windows servers are sending security event logs to a central syslog server - they are not in Windows event log format, they are converted to syslog (by Corelog).

Our central syslog server receives the converted Windows security event logs and places them in a unique file /var/log/windows. At this point a Splunk light forwarder sends the data to our Splunk indexer.

The Splunk indexer receives the Windows syslog where I've defined a new sourcetype (based from the source file /var/log/windows), and filtered for only certain event ID's by defining a new field windows_error_code

My question(s) is this - has anyone defined any apps that will read syslog data that is actually created from Windows Event logs?

Any suggestions on how I can use the windows/syslog data without too much re-inventing the wheel?

Thanks!

Tags (1)
0 Karma

starcher
SplunkTrust
SplunkTrust

Without seeing the exact format of the syslog entries it sounds like you are going to be forced into working up a number of regex extractions for your new sourcetype. Is there a reason such as license limitation that you are not just deploying the universal forwarder with the windows TA to the systems you want logs from?

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...