How to ingest exported sysmon logs to Splunk?

[mawni]

Hello Guys

I'm trying to ingest exported sysmon logs file to Splunk. I got the file from Splunk attack_data repository. I have already installed Microsoft sysmon add-ons.

Splunk attack_data's link: 

Every time when I choose xmlWinEventLog:Microsoft-Windows-Sysmon/Operational as a source type, it gives me error Not found.  appreciate your support, how can I ingest exported sysmon logs to splunk?

Thanks, Awni

[Albert_Cyber]

Did you ever find a solution for this? Looking at the below documentation it seems that this is not supported https://docs.splunk.com/Documentation/Splunk/9.1.2/Data/Uploaddata

[richgalloway]

On which Splunk instance(s) did you install the sysmon add-ons?

There is no link in the question.

What exactly are you trying to do when you choose xmlWinEventLog:Microsoft-Windows-Sysmon/Operational as a source type?  What are you choosing it from?  Which Splunk instance are you using at the time?