Getting Data In

Why disk space on splunk forwarder is filling up with *.evtx log files?

Path Finder

$Splunk_Home\var\run\splunk\upload is filling up with *.evtx log files. Right now I am baby sitting this server as it is constantly filling up the Disk space. I have gone through the log.cfg configuration and can't find how to turn this logging off. Any ideas?

0 Karma

Contributor

Are you trying to ingest EVTX files?

If so it can't read directly from EVTX. Instead when you install the windows forwarder use the check boxes to select the appropriate log formats to ingest; security, system, application, etc.

0 Karma

Path Finder

I'm trying to ingest a directory full of archived event logs. Our security team has zipped up a years worth of logs, and yes they are in EVTX files. I selected the formats to ingest when I installed the splunk agent.

Are you saying that I can not splunk this data?

0 Karma

Path Finder

Help!! Anyone?

0 Karma

Path Finder

Nobody has any info on this on how to turn off logging here?

0 Karma