Getting Data In

Windows Eventlogs (Extract RAW from one splunk and import to another)

PatrikL
Observer

We are currently changing our splunk server to a new one and during the change there was a mix up and we got data sent to the old instance (about 12h worth) which we would like to transfer to our new splunk instance.

My thought was to do a search on the old one and then export the results, when I do this as a RAW format and then import it to the new one the data looks good but the field extracts for WinEventLog is not applied as it should (even tho I use the same Event type) how can I solve this?

I've also tried to export it as xml, json, csv but the data looks worse than using RAW

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @PatrikL,

you should extract WinEventLog row data by sourcetype, source and host and then import in the new system manually using these values.

Ciao.

Giuseppe

0 Karma

PatrikL
Observer

Thanks for the reply, could you please provide an example? I'm not quite understanding what you mean? should I add sourcetype, source and host to the search before export?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @PatrikL,

you have to list the hosts for each sourcetype and source and then extract datarunning a simple search e.g.:

index=winwvwntlog sourcetype=xmlwineventlog source=WinEventLog:Security host=host1

and then manually load it  (using the Add Data Featrure) and using the above fields.

You could eventually save the files using the with the host name as folder and then use an automatic assignment of the host.

But anyway, it's a long job.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...