CODEWITHSUNDEEP
splunkevent-viewer
D-Dub
D-Dub

Reputation: 1

Event viewer logs to .txt file non-encrypted

Is there any way to get event viewer logs to .txt file. I tried going to event viewer properties and changing dir and .txt.

However when opening .txt it seems to be encrypted. Want plain text so that I can send to splunk and have a dashboard set up.

Thanks

Upvotes: 0

Views: 484

Answers (1)

Simon Duff
Simon Duff

Reputation: 2651

Refer to https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/MonitorWindowseventlogdata#Index_exported_event_log_.28.evt_or_.evtx.29_files

An .evtx file is a binary representation of the Event Viewer Log file. Due to the way Microsoft writes these files, it relies on the DLLs of the server that produces these files, so the files can only be open on the same machine, or at least, very similarly configured.

Splunk should be able to open these files by using a regular monitor input. Don't set a sourcetype, as it will be automatically extracted.

Alternatively, you may have some luck with https://github.com/vavarachen/evtx2json

Upvotes: 2

Related Questions