Alloy, Windows Eventlog and Splunk

Grafana Alloy
1

Hi,

Is it technically possible to send Windows Eventlog data from Windows with Alloy to Splunk untouched?

We have tried to replace the Splunk forwarder with Alloy, but then the log data is received as JSON in our Splunk instance, and the default Eventlog-Splunk parser does not work.

We are using: loki.source.windowsevent and otelcol.exporter.splunkhec

Thank you, cnu

2

I believe it does it as json by default.

you could use this to get what you need?

stage.json {
    expressions = {
        level  = "levelText",
        source = "source",
    }
}
3

You can send Windows Eventlog data to Splunk via Alloy in the native format Splunk expects, but your current setup is converting events to JSON. You need to add an otelcol.processor.transform component to your pipeline to reformat the data before sending it to Splunk HEC. This transform should convert the structured data into the format that Splunk’s default Eventlog parser expects. Configure the HEC exporter with the correct sourcetype (WinEventLog) and ensure your transformation matches Splunk’s expected format.