Deployment Architecture

How to index exported .evt and .evtx files?

wuming79
Path Finder

I tried the following:

settings -> Add Data -> Upload Data -> choose xxx.evt as my source and I'm lost at "Set Source Type". My default source-type shows "preprocess-winevt". I found another source type call Event Log, but when I chose it, the preview is still displayed as hex values.

I have been directed to http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorwindowsdata many times and I don't understand what it is trying to say in the document....how do I index all my exported evt and evtx files?

I'm on trial version.

Tags (2)
1 Solution

adonio
Ultra Champion

settings -> data inputs (top right corner) -> local event log collection -> pick the windows logs you want
read here more:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/HowtogetWindowsdataintoSplunk

View solution in original post

0 Karma

adonio
Ultra Champion

settings -> data inputs (top right corner) -> local event log collection -> pick the windows logs you want
read here more:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/HowtogetWindowsdataintoSplunk

0 Karma

arechenberg
Explorer

This answer assumes that Splunk is running on the same machine as the Windows log files. I believe the intent of the question was how to index *.evtx files that have been exported from a machine as files and then import them into a different machine running Splunk.

I would like to know an answer to this question as well. Having a similar problem - I upload the evtx file, file recognized by Splunk as preprocess-winevt, complete the import but no data is indexed by Splunk, or very old events (e.g. events from November 2016) are indexed.

Any help is much appreciated, Andy

dantimola
Communicator

Hi arechenberg,

I've resolved this kind of problem by just converting .evtx file to .txt file, you can do it by opening the .evtx file on the Windows Event Viewer on your local machine and save it as Text file or CSV, after converting .evtx file to text file or csv you may now ingest in to your splunk. I've provided link on how to save windows event as text file or csv below.

https://technet.microsoft.com/en-us/library/cc749339(v=ws.11).aspx

dantimola
Communicator

What if i exported .evtx file from other machine and i want to ingest it to our splunk?

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...