All Apps and Add-ons

Is there any way to manually load a Windows event log into Splunk?


Hello all,

is there any way to manually load a Windows Event log into Splunk? I have an EVT file from another machine, but want to load it into a local copy of Splunk for analysis. It is easy to add the event logs local Windows instance, and you can of course forward event logs from another machine, but is there any way to manually load in EVT logs??? A workaround is to convert the EVT files to CSV, but it would be good to do it without having to convert first???


New Member

nice post click here

<a href="">find job</a>

0 Karma

Splunk Employee
Splunk Employee

I have run into this a few times where someone was needing to load an EVT file into Splunk just as you described. The problem is that EVT files are binary. You will need to write some code to convert that file to text (or CSV).

If these for one-off situations, such as doing forensics, here is a link I found to some code that will do the conversion; probably not what you were wanting to hear, but maybe others will in the community will have another solution. Here is the link to the code, written in C#: You may even try this utility:

Hope this helps.

Happy Splunking!



OK, thanks for the pointers, but they seem to be a workaround. I'm not clear on what the actual issue is as Splunk must surely be able to understand the binary, as it can read the logs from the host machine for example?

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...