https://community.splunk.com/t5/Splunk-Enterprise/How-to-ingest-exported-sysmon-logs-to-Splunk/m-p/620687#M14503 <P>On which Splunk instance(s) did you install the sysmon add-ons?</P><P>There is no link in the question.</P><P>What exactly are you trying to do when you choose&nbsp;<SPAN>xmlWinEventLog:Microsoft-Windows-Sysmon/Operational as a source type?&nbsp; What are you choosing it from?&nbsp; Which Splunk instance are you using at the time?</SPAN></P> Sun, 13 Nov 2022 21:59:33 GMT richgalloway 2022-11-13T21:59:33Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-ingest-exported-sysmon-logs-to-Splunk/m-p/620676#M14500 <P>Hello Guys</P> <P>I'm trying to ingest exported sysmon logs file to Splunk. I got the file from Splunk attack_data repository. I have already installed Microsoft sysmon add-ons.</P> <P>Splunk attack_data's link:&nbsp;</P> <P>&nbsp;</P> <P>Every time when I choose xmlWinEventLog:Microsoft-Windows-Sysmon/Operational as a source type, it gives me error Not found.&nbsp; appreciate your support, how can I ingest exported sysmon logs to splunk?</P> <P>&nbsp;</P> <P>Thanks, Awni</P> Mon, 14 Nov 2022 13:28:14 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-ingest-exported-sysmon-logs-to-Splunk/m-p/620676#M14500 mawni 2022-11-14T13:28:14Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-ingest-exported-sysmon-logs-to-Splunk/m-p/620687#M14503 <P>On which Splunk instance(s) did you install the sysmon add-ons?</P><P>There is no link in the question.</P><P>What exactly are you trying to do when you choose&nbsp;<SPAN>xmlWinEventLog:Microsoft-Windows-Sysmon/Operational as a source type?&nbsp; What are you choosing it from?&nbsp; Which Splunk instance are you using at the time?</SPAN></P> Sun, 13 Nov 2022 21:59:33 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-ingest-exported-sysmon-logs-to-Splunk/m-p/620687#M14503 richgalloway 2022-11-13T21:59:33Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-ingest-exported-sysmon-logs-to-Splunk/m-p/672688#M18198 <P>Did you ever find a solution for this? Looking at the below documentation it seems that this is not supported&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/Uploaddata" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/Uploaddata</A></P> Tue, 26 Dec 2023 17:10:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-ingest-exported-sysmon-logs-to-Splunk/m-p/672688#M18198 Albert_Cyber 2023-12-26T17:10:45Z