https://community.splunk.com/t5/Getting-Data-In/About-export-evt-file-format/m-p/97184#M20269 <P>Gooday Splunkers!!!</P> <P>Can you give me tips on how i can upload a .evt file to splunk?</P> <P>Because i have a xxxx.evt here and how i can add as a data to splunk? and convert it as csv file.</P> <P>i been reading this </P> <P><A href="http://">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorwindowsdata</A></P> <P>and it did not resolve mu issue</P> <P>Thanks and Regards<BR /> Cris</P> Sat, 20 Oct 2012 09:27:31 GMT christantoy 2012-10-20T09:27:31Z https://community.splunk.com/t5/Getting-Data-In/About-export-evt-file-format/m-p/97184#M20269 <P>Gooday Splunkers!!!</P> <P>Can you give me tips on how i can upload a .evt file to splunk?</P> <P>Because i have a xxxx.evt here and how i can add as a data to splunk? and convert it as csv file.</P> <P>i been reading this </P> <P><A href="http://">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorwindowsdata</A></P> <P>and it did not resolve mu issue</P> <P>Thanks and Regards<BR /> Cris</P> Sat, 20 Oct 2012 09:27:31 GMT https://community.splunk.com/t5/Getting-Data-In/About-export-evt-file-format/m-p/97184#M20269 christantoy 2012-10-20T09:27:31Z https://community.splunk.com/t5/Getting-Data-In/About-export-evt-file-format/m-p/97185#M20270 <P>Usually you don't read directly the WindowsEventLogs, and use the special inputs that calls the windows system API.</P> <P>However if you have evt files exported (not locked or touched by windows), you can to monitor them as regular files :</P> <UL> <LI>please apply the correct sourcetype based on the actual log type ( by example WinEventLog:Application) see <A href="http://splunk-base.splunk.com/answers/37343/sourcetype-for-windows-event-logs">http://splunk-base.splunk.com/answers/37343/sourcetype-for-windows-event-logs</A></LI> <LI>please import the log file on the same OS version in order to translate them correctly see <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata#Index_exported_event_log_.28.evt_or_.evtx.29_files">http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata#Index_exported_event_log_.28.evt_or_.evtx.29_files</A></LI> </UL> Sun, 21 Oct 2012 04:54:57 GMT https://community.splunk.com/t5/Getting-Data-In/About-export-evt-file-format/m-p/97185#M20270 yannK 2012-10-21T04:54:57Z