Getting Data In

About export .evt file format

christantoy
Path Finder

Gooday Splunkers!!!

Can you give me tips on how i can upload a .evt file to splunk?

Because i have a xxxx.evt here and how i can add as a data to splunk? and convert it as csv file.

i been reading this

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorwindowsdata

and it did not resolve mu issue

Thanks and Regards
Cris

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Usually you don't read directly the WindowsEventLogs, and use the special inputs that calls the windows system API.

However if you have evt files exported (not locked or touched by windows), you can to monitor them as regular files :

Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...