Migrate your Windows saved searches to 3.3.x and later
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Migrate your Windows saved searches to 3.3.x and later
Use the information in this topic if you are upgrading from a version of Splunk for Windows that is older than 3.3.
Some Splunk terminology for Windows-specific field names has changed or been added starting in version 3.3. These changes were made to better reflect commonly-used Windows terminology. As a result, you must migrate any existing saved searches you created in 3.2.x to use the new terminology. Splunk provides a script for you to do this.
The script backs up any saved searches that appear to contain the deprecated terms, and converts them to use the new terminology.
- You have the option of seeing a preview of what the script will change when you run it.
- If you are deploying to multiple servers, perhaps using automation of some kind, you can also skip the 5 second pause Splunk introduces by default to let you read the informational text that is displayed when you run the script by hand.
Run the migration script
To run the migration script without seeing a preview and with the 5 second pause, from $SPLUNK_HOME, run:
./splunk migrate win-searches
Optional parameters:
- To see a preview of the changes Splunk will make, use
-dry-run true(the default isfalse). - To skip the 5 second pause, use
-no-wait true(the default isfalse).
What has changed
The following field names are new:
-
Category -
EventType -
Message
The following field names have changed:
-
evtlog_category->CategoryString -
evtlog_id->EventCode -
evtlog_severity->Type -
evtlog_account->User -
evtlog_domain->ComputerName -
evtlog_sid->Sid -
evtlog_sid_type->SidType
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.