How to index exported .evt and .evtx files?

[wuming79]

I tried the following:

settings -> Add Data -> Upload Data -> choose xxx.evt as my source and I'm lost at "Set Source Type". My default source-type shows "preprocess-winevt". I found another source type call Event Log, but when I chose it, the preview is still displayed as hex values.

I have been directed to http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorwindowsdata many times and I don't understand what it is trying to say in the document....how do I index all my exported evt and evtx files?

I'm on trial version.

[adonio · Accepted solution]

settings -> data inputs (top right corner) -> local event log collection -> pick the windows logs you want
read here more:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/HowtogetWindowsdataintoSplunk

[arechenberg]

This answer assumes that Splunk is running on the same machine as the Windows log files. I believe the intent of the question was how to index *.evtx files that have been exported from a machine as files and then import them into a different machine running Splunk.

I would like to know an answer to this question as well. Having a similar problem - I upload the evtx file, file recognized by Splunk as preprocess-winevt, complete the import but no data is indexed by Splunk, or very old events (e.g. events from November 2016) are indexed.

Any help is much appreciated, Andy

[dantimola]

Hi arechenberg,

I've resolved this kind of problem by just converting .evtx file to .txt file, you can do it by opening the .evtx file on the Windows Event Viewer on your local machine and save it as Text file or CSV, after converting .evtx file to text file or csv you may now ingest in to your splunk. I've provided link on how to save windows event as text file or csv below.

https://technet.microsoft.com/en-us/library/cc749339(v=ws.11).aspx

[dantimola]

What if i exported .evtx file from other machine and i want to ingest it to our splunk?