All our windows servers are sending security event logs to a central syslog server - they are not in Windows event log format, they are converted to syslog (by Corelog).
Our central syslog server receives the converted Windows security event logs and places them in a unique file /var/log/windows. At this point a Splunk light forwarder sends the data to our Splunk indexer.
The Splunk indexer receives the Windows syslog where I've defined a new sourcetype (based from the source file /var/log/windows), and filtered for only certain event ID's by defining a new field windows_error_code
My question(s) is this - has anyone defined any apps that will read syslog data that is actually created from Windows Event logs?
Any suggestions on how I can use the windows/syslog data without too much re-inventing the wheel?
Thanks!