Getting Data In

How to convert bulk evtx files in a folder to CSV files for ingestion?

sbgoldberg13
Explorer

Hi all. I have a folder with about 200 evtx files. The following command works for 1 file. How can I process/convert all of the evtx files to csv at once? Thanks.

Get-WinEvent -Path C:\somewhere\foo.evtx | Export-CSV C:\somewhere\foo.csv

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is more of an OS/shell problem than a Splunk problem.  You should able to use the shell's looping constructs to iterate over the files in the folder.

Get-ChildItem –Path "C:\somewhere" |
  Foreach-Object {
  #Do something with $_.FullName
}
---
If this reply helps you, Karma would be appreciated.
0 Karma

sbgoldberg13
Explorer

I tried this command, modified with get-winevent piped to export-csv but no luck. How do I iterate so it changes each xxx.evtx to xxx.csv, yyy.evtx to yyy.csv, etc. Thanks.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That would be a question for a Powershell forum.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...