Importing Kiwi logs to Splunk

dunky2k

Can anyone confirm if a log file that has been created as part of a processing rule can be used as an import source for a Splunk Instance, and is anyone currently doing this?

We currently use the free Solarwinds Event Log forwarder to send all of our AD event logs to our Kiwi Syslog Server, from there we processes these messages and amongst other things output these messages to a log file that we wish to use an an import source.

Splunk seem to imply that these log files cannot be used as an input source using their native Splunk add-on for Microsoft Windows, however i believe that Solarwinds imply that these can be used for import to a Splunk instance.

So who is right and who is wrong, and how can it be done if it can be done, have i potentially missed a step?

PJC

Yes, this can work. The Splunk Add-on for Microsoft Windows is not the component you need for arbitrary Kiwi text files. Install a Splunk Universal Forwarder on the Kiwi server and configure a file monitor for the folder where Kiwi writes the logs, with the appropriate index and sourcetype, for example:

[monitor://C:\Path\To\KiwiLogs\*.txt]
index = your_index
sourcetype = syslog
disabled = 0

Kiwi’s ISO, tab-delimited format is a good starting point. Make sure the Forwarder service account can read the folder, and configure log rotation so Splunk continues to pick up new files. If you need native Windows Event Log fields, send the events directly to Splunk; once they are written to text by Kiwi, they will need to be parsed on the Splunk side.

See Splunk’s file monitoring documentation and Kiwi’s available log formats.