About BabySplunk

BabySplunk · ‎12-02-2022

I have it showing results now, but the table header tags that I typically use with my forwarded data is not matching up in the CSV import. For instance, I normally use "| table _time,Account_Name,Message,EventCode" but nothing matches from the CSV import. It reads as "Event ID" instead of EventCode and "EXTRA_FIELD_" instead of Message and "Account_Name" returns no results.

BabySplunk · ‎12-01-2022

Yes, I see them and my data is now populating but when I complete the upload and attempt a search, I'm still getting "no results found".

BabySplunk · ‎11-30-2022

No results.

BabySplunk · ‎11-30-2022

I did a one-time upload via the SplunkEnterprise webpage and followed the wizard.

BabySplunk · ‎11-30-2022

The index is titled "main"

BabySplunk · ‎11-30-2022

Thanks for your help, but I'm still returning no results.

BabySplunk · ‎11-30-2022

I decided to convert them to CSV to make it a bit easier. I followed the video you linked, but now I'm getting no results returned via search. Here's my search string: source="filename.csv" sourcetype="csv" | search EventCode=4624 | table _time, Account_Name, Message

BabySplunk · ‎11-30-2022

Hello all! I am brand new to Splunk and have learned quite a bit so far from this forum, so thank you! With that being said, I am currently trying to import event logs from another system to scan on my local instance of Splunk. I've tried moving the EVTX files into my winevt directory, but that didn't work. I'm getting very frustrated and any help would be appreciated. -BabySplunk

Posts	8
Solutions	0
Karma Given	10
Karma Received	0
Member Since	‎11-30-2022

Online Status	Offline
Date Last Visited	‎12-02-2022 11:07 AM

How to import event logs from another system to sc...

Re: Importing Event Logs

Re: Importing Event Logs

Re: Importing Event Logs

Re: Importing Event Logs

Re: Importing Event Logs

Re: Importing Event Logs

Re: Importing Event Logs

How to import event logs from another system to sc...