Hi. I have tried to export large number of events from a Splunk instance to another instance to work with the data (i.e.create dashboards etc). When I tried to upload the exported csv file into the Splunk instance, it looks messed up in the data preview. They are all from known sources (i.e. iis data, win event logs etc). How do i correct this? Or is there any better way to do it?
If you want the data to look exactly the same, you really need to have it ingested in the same way. That means your target machine must have all the same configurations to extract and transform the data.
Also, make sure that you are exporting the _raw, as opposed to a formatted CSV file of the pre-chewed information.
@aoliullah - Did the answer provided by DalJeanis help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!