topic Re: How to index exported .evt and .evtx files? in Deployment Architecture

How to index exported .evt and .evtx files?

wuming79 — Tue, 16 May 2017 05:48:43 GMT

I tried the following:

settings -> Add Data -> Upload Data -> choose xxx.evt as my source and I'm lost at "Set Source Type". My default source-type shows "preprocess-winevt". I found another source type call Event Log, but when I chose it, the preview is still displayed as hex values.

I have been directed to http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorwindowsdata many times and I don't understand what it is trying to say in the document....how do I index all my exported evt and evtx files?

I'm on trial version.

Re: How to index exported .evt and .evtx files?

adonio — Tue, 16 May 2017 18:03:47 GMT

settings -> data inputs (top right corner) -> local event log collection -> pick the windows logs you want
read here more:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/HowtogetWindowsdataintoSplunk

Re: How to index exported .evt and .evtx files?

dantimola — Wed, 16 Aug 2017 08:09:09 GMT

What if i exported .evtx file from other machine and i want to ingest it to our splunk?

Re: How to index exported .evt and .evtx files?

arechenberg — Mon, 21 Aug 2017 22:09:19 GMT

This answer assumes that Splunk is running on the same machine as the Windows log files. I believe the intent of the question was how to index *.evtx files that have been exported from a machine as files and then import them into a different machine running Splunk.

I would like to know an answer to this question as well. Having a similar problem - I upload the evtx file, file recognized by Splunk as preprocess-winevt, complete the import but no data is indexed by Splunk, or very old events (e.g. events from November 2016) are indexed.

Any help is much appreciated, Andy

Re: How to index exported .evt and .evtx files?

dantimola — Wed, 23 Aug 2017 06:39:49 GMT

Hi arechenberg,

I've resolved this kind of problem by just converting .evtx file to .txt file, you can do it by opening the .evtx file on the Windows Event Viewer on your local machine and save it as Text file or CSV, after converting .evtx file to text file or csv you may now ingest in to your splunk. I've provided link on how to save windows event as text file or csv below.

https://technet.microsoft.com/en-us/library/cc749339(v=ws.11).aspx