We needed to retrieve a older evtx file from storage. We placed the file in c:\temp and we created an app to ingest it. Here's the app:
[WinEventLog://Archive-Application-2019-04-04-08-00-56-870]
disabled = 0
current_only = 0
checkpointInterval = 5
index = windows
renderXml=false
We've added the full path to the file name like this:
[WinEventLog://c:\temp\Archive-Application-2019-04-04-08-00-56-870]
We've added the file extension like this:
[WinEventLog://c:\temp\Archive-Application-2019-04-04-08-00-56-870.evtx]
We've deleted fishbucket, we've deleted persistent storage on every splunk restart. Still we get the message, "Failed to find Event Log with channel name=Archive-Application-2019-04-04-08-00-56-870"
We tried splunk add oneshot --that didn't work at all. What do we need to do to ingest this file. Thanks.
