Getting Data In

How to index evtx files in Splunk?

chanduira
Explorer

Hi Experts,

We have around 100 evtx files, and we want to index these files in Splunk and do analysis.

But when we configure it in inputs.conf both on the universal forwarder and Splunk itself, (from Splunk Web), it does not get indexed.

Kindly help with steps.

inventsekar
SplunkTrust
SplunkTrust

The documentation on how to do this exists here:
http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWindowsdata

In short, you can add these files as inputs, but be sure that these files are not being written to while splunk reads it.
Also, unlike other log files, using the upload function will not work with these files. Splunk will recognize the file by the file extension .evt or .evtx. Since Splunk utilizes native Windows APIs to extract information from these files, you need to run Splunk on windows.

from another answer -
We've had several problems with this issue. Actually the Splunk docs is a bit misleading on this. The only guaranteed method to index Windows Event Logs events is to define a native input on a Splunk instance -could be a (light)forwarder too- on the same windows machine that generate the Events to index (add for instance a [WinEventLog:Application] stanza in inputs.conf).
As you can see from the last updated docs (http://www.splunk.com/base/Documentation/4.1.1/Admin/MonitorWindowsdata ), indexing exported evt data has several limitations, due to the Microsoft proprietary way to generate those .evt files, which embed links to the DLLs used to generate them.

So take care when planning a Splunk deployment were there will be several evt files (or data) to index!

more on this -
https://answers.splunk.com/answers/141/can-splunk-index-windows-event-log-evt-evtx-files.html

workaround -
maybe, you can try to convert these files to text files or csv files and upload to splunk.
http://serverfault.com/questions/783708/convert-saved-evtx-files-to-text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...