Getting Data In

Why disk space on splunk forwarder is filling up with *.evtx log files?

shandman
Path Finder

$Splunk_Home\var\run\splunk\upload is filling up with *.evtx log files. Right now I am baby sitting this server as it is constantly filling up the Disk space. I have gone through the log.cfg configuration and can't find how to turn this logging off. Any ideas?

0 Karma

hagjos43
Contributor

Are you trying to ingest EVTX files?

If so it can't read directly from EVTX. Instead when you install the windows forwarder use the check boxes to select the appropriate log formats to ingest; security, system, application, etc.

0 Karma

shandman
Path Finder

I'm trying to ingest a directory full of archived event logs. Our security team has zipped up a years worth of logs, and yes they are in EVTX files. I selected the formats to ingest when I installed the splunk agent.

Are you saying that I can not splunk this data?

0 Karma

shandman
Path Finder

Help!! Anyone?

0 Karma

shandman
Path Finder

Nobody has any info on this on how to turn off logging here?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...