Monitoring Splunk

how to open evt files

jebrown
New Member

How to open saved evt files from 2003 sbs

Tags (1)
0 Karma

MHibbin
Influencer

Hi,

You should read the following section of the docs:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/MonitorWindowsdata#Index_exported_event_log_....

And then you should read:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/MonitorFilesandDirectories

Fairly simple file monitor really... You will just have to make sure that you are reading the files using a Windows based Splunk instance, as it will need to access the Windows binaries for reading the EVT/EVTX files.

Hope this helps answer your question.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...