Getting Data In

Ingest old security.evtx files

sswigart
Explorer

I am running windows version of Splunk Enterprise 9.4.2 stand alone. I have 17 older security logs saved in a  separate folder. I want to ingest these logs into a new index and run queries on the ingested logs.  How can I do that? 

Labels (3)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @sswigart 

I think you should be able to setup a monitor in inputs.conf but using the "preprocess-winevt" sourcetype, although I havent done this for some time.

#inputs.conf
[monitor://Path/To/Your/security.evxt]
index=yourNewIndex
sourcetype=preprocess-winevt

Also check out https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Log-evtx-file-import-Foriegn-AD-Domain...for more info on this approach.

🌟 Did this answer help you? If so, please consider:

    • Adding karma to show it was useful
    • Marking it as the solution if it resolved your issue
    • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...