I am trying to use Splunk to review windows events that have been exported from disconnected systems.
I have all the exported .evtx files located in a local folder.
I add that folder to the data inputs and have disabled everything else in data inputs.
In the search box I have source="c:\\Events\\*". Everything looks good but if I put the curser back at the end of the search string an press enter (not changing the search string at all) the number of events goes up.
I can't figure out why this is happening since the .evtx files in that folder are not changing.
