Backfill WinEvtLog files | Windows UFs

Applicability

Description

When WinEvtLog files are dropped and not sent to Splunk Cloud, this article provides steps on how to backfill the missing data and send it to Splunk Cloud.

Investigation

Run the following SPL on Splunk Cloud to check data. If data is missing for a specific time period, please contact Splunk Support to validate whether the logs were successfully received.

index=win_xx_index

Resolution

Steps to backfill WinEvtLog files to Splunk Cloud:

1.Export the Specific Timeframe Using PowerShell: Run a PowerShell command across target endpoints to extract events strictly within the missing window:

$StartTime = [DateTime]::Parse("2026-09-23 15:00:00").ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.000Z")
$EndTime = [DateTime]::Parse("2026-09-25 16:00:00").ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.000Z")
$XPath = "*[System[TimeCreated[@SystemTime >= '$StartTime' and @SystemTime <= '$EndTime']]]"
$Session = New-Object -TypeName System.Diagnostics.Eventing.Reader.EventLogSession
$Session.ExportLog("Security", [System.Diagnostics.Eventing.Reader.PathType]::LogName, $XPath, “C:\Temp\Security_backfill.evtx")
$Session.ExportLog("Ssystem, [System.Diagnostics.Eventing.Reader.PathType]::LogName, $XPath, “C:\Temp\System_backfill.evtx") 

2. Batch/Monitor Input: Place the exported files into a designated folder and configure a temporary.

[monitor://C:\Temp\*.evtx]
disabled = 0
index = win_xxx_index
crcSalt = <SOURCE>

3. Restart the UFs: Restart splunk

4. Validate: Run the following SPL Search on Splunk Cloud:

index=win_xx_index earliest="09/23/2026:15:00:00" latest="09/25/2026:16:00:00" host=xxhostxx
| table _time,_raw

5. Clean up: once events are ingested, remove temp evtx files. removove monitor stanza from inputs.conf, restart forwarder