Getting Data In

Adding new data to Splunk

New Member


We have a new Splunk system as the new log management system. Previously we used Manage Engine Enterprise Log Management. Ther about large amount of data that I need to get accross to the Splunk.

ELA indexed data is not encryoted. So I just copied the data files to the Splunk server local drive and then ran the add files/directoris to preview it and it looks ok.
My question is is this the right way to do this. Sicen I am going to frozen this data after loading to splunk I am going to create a new indeexed so it will not get confused with teh current data coming in. This is once of operation and once I am through with all the data to Splunk then ELA will be decommisioned.

Also these data consits of Windows event logs Active Direcoty , Linux and Network device syslogs. When I load these to Splunk how will it pickup the source types? Do I have manually mentioned the source type?


Tags (5)
0 Karma

Splunk Employee
Splunk Employee

it sounds to me as though you're going about this correctly--bringing your legacy data into a separate index is a good call. one thing to make sure you understand is how Splunk archives/freezes data, described here:

in terms of the source types, if your data is of a standard format (AD, OS, and network devices are all pretty standard), Splunk should do the right thing by default. read more about that here:

hope this is useful.

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...