About export .evt file format - Splunk Community

Getting Data In

Gooday Splunkers!!!

Can you give me tips on how i can upload a .evt file to splunk?

Because i have a xxxx.evt here and how i can add as a data to splunk? and convert it as csv file.

i been reading this

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorwindowsdata

and it did not resolve mu issue

Thanks and Regards
Cris

Usually you don't read directly the WindowsEventLogs, and use the special inputs that calls the windows system API.

However if you have evt files exported (not locked or touched by windows), you can to monitor them as regular files :

please apply the correct sourcetype based on the actual log type ( by example WinEventLog:Application) see http://splunk-base.splunk.com/answers/37343/sourcetype-for-windows-event-logs
please import the log file on the same OS version in order to translate them correctly see http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata#Index_exported_event_log_.28...

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...