Splunk Search

Failed to find Event Log with channel name

halbeisendv
Path Finder

We needed to retrieve a older evtx file from storage. We placed the file in c:\temp and we created an app to ingest it. Here's the app:

[WinEventLog://Archive-Application-2019-04-04-08-00-56-870]
disabled = 0
current_only = 0
checkpointInterval = 5
index = windows
renderXml=false

We've added the full path to the file name like this:
[WinEventLog://c:\temp\Archive-Application-2019-04-04-08-00-56-870]

We've added the file extension like this:
[WinEventLog://c:\temp\Archive-Application-2019-04-04-08-00-56-870.evtx]

We've deleted fishbucket, we've deleted persistent storage on every splunk restart. Still we get the message, "Failed to find Event Log with channel name=Archive-Application-2019-04-04-08-00-56-870"

We tried splunk add oneshot --that didn't work at all. What do we need to do to ingest this file. Thanks.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...