Ingest old security.evtx files

sswigart — Tue, 23 Sep 2025 21:53:08 GMT

I am running windows version of Splunk Enterprise 9.4.2 stand alone. I have 17 older security logs saved in a separate folder. I want to ingest these logs into a new index and run queries on the ingested logs. How can I do that?

Re: Ingest old security.evtx files

livehybrid — Wed, 24 Sep 2025 07:59:02 GMT

Hi @sswigart

I think you should be able to setup a monitor in inputs.conf but using the "preprocess-winevt" sourcetype, although I havent done this for some time.

#inputs.conf [monitor://Path/To/Your/security.evxt] index=yourNewIndex sourcetype=preprocess-winevt

Also check out https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Log-evtx-file-import-Foriegn-AD-Domain/m-p/557631 for more info on this approach.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

topic Ingest old security.evtx files in Getting Data In

Ingest old security.evtx files

Re: Ingest old security.evtx files