All Apps and Add-ons

Is there any way to manually load a Windows event log into Splunk?


Hello all,

is there any way to manually load a Windows Event log into Splunk? I have an EVT file from another machine, but want to load it into a local copy of Splunk for analysis. It is easy to add the event logs local Windows instance, and you can of course forward event logs from another machine, but is there any way to manually load in EVT logs??? A workaround is to convert the EVT files to CSV, but it would be good to do it without having to convert first???


New Member

nice post click here

<a href="">find job</a>

0 Karma

Splunk Employee
Splunk Employee

I have run into this a few times where someone was needing to load an EVT file into Splunk just as you described. The problem is that EVT files are binary. You will need to write some code to convert that file to text (or CSV).

If these for one-off situations, such as doing forensics, here is a link I found to some code that will do the conversion; probably not what you were wanting to hear, but maybe others will in the community will have another solution. Here is the link to the code, written in C#: You may even try this utility:

Hope this helps.

Happy Splunking!



OK, thanks for the pointers, but they seem to be a workaround. I'm not clear on what the actual issue is as Splunk must surely be able to understand the binary, as it can read the logs from the host machine for example?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...