whikernel / evtx2splunk Goto Github PK

I tried to run in my instance but not working, may I ask what is the difference between, PORT, MPORT, and SSL.
I can't find the "--folder" in the help menu so that I change it to "--input", but still no luck.

python3 evtx2splunk.py --input "~/logs" -v DEBUG --index case_0001 --test

My .env file
SPLUNK_URL = https://splunk.mydomain.com
SPLUNK_PORT = 8089
SPLUNK_MPORT = 8000
SPLUNK_SSL = https
SPLUNK_USER = admin
SPLUNK_PASS =

2021-07-22 12:31:46 ERROR configure: Event ID data file not found
2021-07-22 12:31:46 ERROR configure: Will without resolution
2021-07-22 12:31:46 WARNING configure: Testing mode enabled. NO data will be injected into Splunk
2021-07-22 12:31:46 INFO configure: Init SplunkHelper
2021-07-22 12:31:46 ERROR _request: HTTPSConnectionPool(host='https', port=443): Max retries exceeded with url: //splunk.mydomain.com:8000/services/data/inputs/http (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x10a2db5e0>: Failed to establish a new connection: [Errno 8] nodename nor servname provided, or not known'))
2021-07-22 12:31:46 ERROR _request: Unable to connect to Splunk. Please check URL and ports
2021-07-22 12:31:46 INFO : Finished in 0.019437074661254883

Thanks a lot!

Hello,

Been having issues getting this working. I enabled the HEC as required and I can ping the host and for some reason I cant connect.

I tried it both on a windows and mac with the exact same result. Could you please give some advice if im doing something wrong? or something has changed that doesnt allow this to work anymore.

python3 evtx2splunk.py --input C:\Users\gru3z\Investigation\Logs --index main
2022-11-18 02:19:01 ERROR configure: Event ID data file not found
2022-11-18 02:19:01 ERROR configure: Will without resolution
2022-11-18 02:19:01 INFO configure: Init SplunkHelper
2022-11-18 02:19:03 ERROR _request: HTTPSConnectionPool(host='192.168.15.179', port=8089): Max retries exceeded with url: /services/data/inputs/http (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x0000029863CCAB90>, 'Connection to 192.168.15.179 timed out. (connect timeout=2)'))
2022-11-18 02:19:03 ERROR _request: Unable to connect to Splunk. Please check URL and ports
2022-11-18 02:19:03 INFO : Finished in 2.0103375911712646

.env file

SPLUNK_URL = 192.168.15.179
SPLUNK_PORT = 8000
SPLUNK_MPORT = 8089
SPLUNK_SSL = False
SPLUNK_USER = redacted
SPLUNK_PASS = redacted

I had also tried it for the IRIS app and could not get it working there either. My config is below

/iriswebapp/dependencies/evtxdump_binaries/event_bind.json

Thank you for your time and help.

Warm regards,

Marc