https://community.splunk.com/t5/Getting-Data-In/How-to-get-evtx-Logs-Back-into-the-Windows-Machine/m-p/696128#M115548 <P>Good morning,&nbsp;</P><P>I have been looking for a solution to this problem for a while. What I am trying to accomplish is re-ingesting .evtx files back into the system or another system so that I can use a UF to re-ingest old logs that have been exported and archived. I hope I am clear as it is hard for me to articulate the ask.&nbsp;</P><P>old .evtx files -&gt; Windows Machine (put the logs back into the Windows machine)</P><P>Which will then allow me to use a UF to send re-ingested logs to Splunk. I have tried converting the evtx files to text with a PowerShell script, but this would take a significant amount of time due to the size of my current evtx files. On average it was taking about 30 minutes per log file, and I have too many to count.&nbsp;</P> Tue, 13 Aug 2024 14:15:35 GMT JoshuaJJ 2024-08-13T14:15:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-evtx-Logs-Back-into-the-Windows-Machine/m-p/696128#M115548 <P>Good morning,&nbsp;</P><P>I have been looking for a solution to this problem for a while. What I am trying to accomplish is re-ingesting .evtx files back into the system or another system so that I can use a UF to re-ingest old logs that have been exported and archived. I hope I am clear as it is hard for me to articulate the ask.&nbsp;</P><P>old .evtx files -&gt; Windows Machine (put the logs back into the Windows machine)</P><P>Which will then allow me to use a UF to send re-ingested logs to Splunk. I have tried converting the evtx files to text with a PowerShell script, but this would take a significant amount of time due to the size of my current evtx files. On average it was taking about 30 minutes per log file, and I have too many to count.&nbsp;</P> Tue, 13 Aug 2024 14:15:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-evtx-Logs-Back-into-the-Windows-Machine/m-p/696128#M115548 JoshuaJJ 2024-08-13T14:15:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-evtx-Logs-Back-into-the-Windows-Machine/m-p/696172#M115553 <P>Hi</P><P>have you look and try this?</P><P><A href="https://community.splunk.com/t5/Getting-Data-In/Ingesting-offline-Windows-Event-logs-from-different-systems/m-p/649515" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Ingesting-offline-Windows-Event-logs-from-different-systems/m-p/649515</A></P><P>r. Ismo</P> Tue, 13 Aug 2024 17:43:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-evtx-Logs-Back-into-the-Windows-Machine/m-p/696172#M115553 isoutamo 2024-08-13T17:43:12Z