I have multiple csv files, exported from splunk events of different source types. (WinEventLog:Security, MSAD:NT6:DNS-Zone-Information, etc) I am trying to import these csv files into another Splunk instance. Between setting the source type at import, and changing the INDEXED_EXTRACTIONS=CSV I feel I am close to having some of the data formatted properly in terms of tag-field values and source type.
However, for some of my data, I can not get Splunk to index the values into the correct fields, regardless of the settings I use. Does anyone have any tips/walkthroughs for importing data, previously exported from Splunk? Thanks.
