https://community.splunk.com/t5/Getting-Data-In/Unable-to-ingest-multiple-window-event-log-evtx-files-in-zip/m-p/349476#M64155 <P>We find it's a bug in v6.6.0. It targets to have fix in v6.6.4. </P> Thu, 03 Aug 2017 04:33:10 GMT tlam_splunk 2017-08-03T04:33:10Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-ingest-multiple-window-event-log-evtx-files-in-zip/m-p/349475#M64154 <P>We're using v6.6.0. It's working fine to ingest single zip file of window event log. But we got the problem to ingest multiple zip files of evtx files. The data could be go into Splunk but they have incorrect sourcetype. The sourcetype is random, maybe the name of event log or zip path. Also, the message field inside the event has missing data. Is there any ideas ? </P> Thu, 03 Aug 2017 04:31:00 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-ingest-multiple-window-event-log-evtx-files-in-zip/m-p/349475#M64154 tlam_splunk 2017-08-03T04:31:00Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-ingest-multiple-window-event-log-evtx-files-in-zip/m-p/349476#M64155 <P>We find it's a bug in v6.6.0. It targets to have fix in v6.6.4. </P> Thu, 03 Aug 2017 04:33:10 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-ingest-multiple-window-event-log-evtx-files-in-zip/m-p/349476#M64155 tlam_splunk 2017-08-03T04:33:10Z