Getting Data In

Missing fields on Splunk data export & import

CSReviews
Loves-to-Learn

I have one Splunk instance where I ran a search and exported the data in a csv file, xml file, and a raw file. The data contained is mostly Windows event logs, "process command line", "creator process", ect.

I am trying to import this data into another Splunk instance. When the data is imported, I noticed some fields are missing, like "process command line". I tried each file type and had no success. I also reviewed the data in the fields and all of the fields and values are present. 

 

Essentially, I am trying to import data similar to Splunk BOTS 

GitHub - splunk/botsv3: Splunk Boss of the SOC version 3 dataset.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @CSReviews ,

as @marnall said, running a search, yu probably modify the raw data.

to export data. the best approach is to run a search without table command, only the main search and then export data in raw format.

There's only one issue: you have to run this search separating events fo index, sourcetype and host, and then import data assigning the correct values, otherwise you cannot assign the correct values to these fields.

Ciao.

Giuseppe

marnall
Motivator

If I understand you correctly, you are exporting the results of a search, then importing it in another Splunk instance as new data? This would definitely alter the fields. The exporting of search results is not intended as a method to move data unchanged from one Splunk instance to another.

Are you trying to import BOTS data or to package indexed data in a manner similar to the BOTS data?

0 Karma
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...