$Splunk_Home\var\run\splunk\upload is filling up with *.evtx log files. Right now I am baby sitting this server as it is constantly filling up the Disk space. I have gone through the log.cfg configuration and can't find how to turn this logging off. Any ideas?
If so it can't read directly from EVTX. Instead when you install the windows forwarder use the check boxes to select the appropriate log formats to ingest; security, system, application, etc.
I'm trying to ingest a directory full of archived event logs. Our security team has zipped up a years worth of logs, and yes they are in EVTX files. I selected the formats to ingest when I installed the splunk agent.
