Windows Eventlogs (Extract RAW from one splunk and import to another)

[PatrikL]

We are currently changing our splunk server to a new one and during the change there was a mix up and we got data sent to the old instance (about 12h worth) which we would like to transfer to our new splunk instance.

My thought was to do a search on the old one and then export the results, when I do this as a RAW format and then import it to the new one the data looks good but the field extracts for WinEventLog is not applied as it should (even tho I use the same Event type) how can I solve this?

I've also tried to export it as xml, json, csv but the data looks worse than using RAW

[gcusello]

Hi @PatrikL,

you should extract WinEventLog row data by sourcetype, source and host and then import in the new system manually using these values.

Ciao.

Giuseppe

[PatrikL]

Thanks for the reply, could you please provide an example? I'm not quite understanding what you mean? should I add sourcetype, source and host to the search before export?

[gcusello]

Hi @PatrikL,

you have to list the hosts for each sourcetype and source and then extract datarunning a simple search e.g.:

index=winwvwntlog sourcetype=xmlwineventlog source=WinEventLog:Security host=host1

and then manually load it  (using the Add Data Featrure) and using the above fields.

You could eventually save the files using the with the host name as folder and then use an automatic assignment of the host.

But anyway, it's a long job.

Ciao.

Giuseppe