How to index Windows EventLogs with Splunk

splunk_xml_evtx

1. Parse evtx logs with evtxdump.py (https://github.com/williballenthin/python-evtx)

2. Create custom Splunk sourcetype "winevtx":

Edit $SPLUNK_HOME/etc/system/local/props.conf

[winevtx]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = ^\<Event xmlns=
TIME_PREFIX = SystemTime=
REPORT-extract-data = extract_data
KV_MODE = xml

Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[extract_data]
REGEX = \<Data Name="(?<_KEY_1>[^\>]*)"\>(?<_VAL_1>[^\<]+)

3. Index XML EventLog files assigning this new sourcetype "winevtx".