See link below for walkthough https://www.cloud-response.com/2019/07/importing-windows-event-log-files-into.html Key is to monitor evtx files using the special preprocess-event sourcetype on a windows instance of Splunk. Takeaways: 1. Copy evtx to spare windows server 2. Load as many services as possible for known content (IE if evtx for AD load AD etc) 3. Install Splunk 4. Monitor directory with evtx files NOTE I did this on a Windows EC2 instance successfully, stopped Splunk on Windows EC2 instance and then copied the following over to my test instance of Splunk on my Mac to faster / more direct access to the parsed evtx: SPLUNK_HOME/var/lib/splunk/wineventlog SPLUNK_HOME/var/lib/splunk/wineventlog.dat ... View more

There are a number of options for this. https://www.splunk.com/blog/2014/10/22/shining-a-light-on-industrial-data.html https://www.kepware.com/en-us/products/kepserverex/advanced-plug-ins/industrial-data-forwarder-splunk/ https://www.kepware.com/getattachment/8e1a5604-6011-4ea5-a2c2-f53cfb79ae47/idf-for-splunk-datasheet.pdf https://splunkbase.splunk.com/app/3922/ https://splunkbase.splunk.com/app/3963/ ... View more

Previous solutions did not work for me. Might be due to version differences. What worked for me was simply adding the wineventlog-ds eventtype to the app for windows infrastructure. IE from within the Splunk App for Windows Infrastructure, click Settings --> Event Types --> New Event Type and add an event type as per the screenshot below: ... View more

Splunk uses a proprietary data store called an index which consists of raw files. It is nothing like a conventional DB. Here is a good explanation of what an index is and how Splunk stores data: http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/Howindexingworks Here is a good explanation of how data is stored in the index: http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/HowSplunkstoresindexes MongoDB is used by Splunk to facilitate certain internal functionality like the kvstore but is by no means where data is stored as it is ingested from Universal Forwarders etc. Data that is ingested from external sources all goes to an index as specified in your configuration. ... View more

I just ran into the same issue on events I was trying to process from exported EVTX files because I did not have the component (StorSimple) installed on my machine. This technique should work for any EVTX export where you do not have the component installed but need to splunk the EVTX data and want to capture all the details of the events. After following this recipe I was able to see all the details of the events in Splunk. My recipe was as follows: Create list of evtx files to convert On Linux or mac machine run the following: find /<path> -type f > filestoconvert.txt EXAMPLE find /Temp/evtx -type f > /Temp/filestoconvert.txt Clean out the trash created by find command with Regex find replace in Sublime or equivalent text editor ^.*/.DS_Store EXAMPLE Find “^.*/.DS_Store” (less the quotes) and replace with nothing Using same find / replace technique, change format to correspond to where you copy the files on the windows host IE C:\Temp\evtx\ Create list of commands for script in Excel using concatenation function. ... Sample of command:  wevtutil qe /lf <fullpath.evtx> > <fullpath.xml> EXAMPLE wevtutil qe /lf C:\Temp\evtx\etw\iSCSITarget.evtx > C:\Temp\evtx\etw\iSCSITarget.xml Loop through commands iteratively by wrapping them in PowerShell script below:  foreach ($command in Get-Content C:\Temp\Convert.txt) { Invoke-Expression $command } Run the script on a Windows 2008+ machine to export the evtx files to XML and expose all the data in the logs. Ingest the XML into Splunk with a stanza similar to the one below in the props.conf of whatever app you want this to live in ... The things of note here are the BREAK_ONLY_BEFORE, TIME_PREFIX, KV_MODE, CHARSET & MAX_EVENTS (assuming you have a lot of events) [StorSimple_XML] BREAK_ONLY_BEFORE = </Event> DATETIME_CONFIG = NO_BINARY_CHECK = true TIME_PREFIX = <TimeCreated SystemTime=' category = Custom pulldown_type = true KV_MODE = xml CHARSET = UTF-16LE TRUNCATE = 0 MAX_EVENTS = 100000000 Again, this approach allowed me to ingest all the data from the evtx files as seen in the UI of the event viewer when looking at the event details in XML view. Had a forwarder been installed in the first place on the source system and configured to send these logs this would not have been necessary but I wanted to share this because sometimes you have to look at EVTX logs in hindsight before a forwarder is installed. ... View more

Minor but important correction, the above did not work in version 6.5.2 until I quoted the target as per the following.: <chart> <searchname> foo </searchname> <drilldown> <link target="_blank">/app/search/dashboardname</link> </drilldwon> </chart> ... View more

Love the idea! I am not seeing that Splunk has this. However, this is similar: http://gosplunk.com/ Also, as it relates to your question I would look at how this is done when using the Splunk Add-on for Tomcat (or maybe even use it): https://splunkbase.splunk.com/app/2911/ Here are is another supporting link for installation / configuration should you go that route: http://docs.splunk.com/Documentation/AddOns/released/Tomcat/Setup ... View more

Adding updated link: http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Howindexingworks ... View more

Perfect Gregg! Thanks for this. Elegant and effective. ... View more