topic Re: Windows Eventlogs (Extract RAW from one splunk and import to another) in Getting Data In

Windows Eventlogs (Extract RAW from one splunk and import to another)

PatrikL — Wed, 06 Mar 2024 11:39:13 GMT

We are currently changing our splunk server to a new one and during the change there was a mix up and we got data sent to the old instance (about 12h worth) which we would like to transfer to our new splunk instance.

My thought was to do a search on the old one and then export the results, when I do this as a RAW format and then import it to the new one the data looks good but the field extracts for WinEventLog is not applied as it should (even tho I use the same Event type) how can I solve this?

I've also tried to export it as xml, json, csv but the data looks worse than using RAW

Re: Windows Eventlogs (Extract RAW from one splunk and import to another)

gcusello — Wed, 06 Mar 2024 12:18:23 GMT

Hi @PatrikL,

you should extract WinEventLog row data by sourcetype, source and host and then import in the new system manually using these values.

Ciao.

Giuseppe

Re: Windows Eventlogs (Extract RAW from one splunk and import to another)

PatrikL — Wed, 06 Mar 2024 12:21:06 GMT

Thanks for the reply, could you please provide an example? I'm not quite understanding what you mean? should I add sourcetype, source and host to the search before export?

Re: Windows Eventlogs (Extract RAW from one splunk and import to another)

gcusello — Wed, 06 Mar 2024 12:53:56 GMT

Hi @PatrikL,

you have to list the hosts for each sourcetype and source and then extract datarunning a simple search e.g.:

index=winwvwntlog sourcetype=xmlwineventlog source=WinEventLog:Security host=host1

and then manually load it (using the Add Data Featrure) and using the above fields.

You could eventually save the files using the with the host name as folder and then use an automatic assignment of the host.

But anyway, it's a long job.

Ciao.

Giuseppe