Follow LogTotal accepts three kinds of files: Windows event logs in EVTX, JSON (one event per line works best), and syslog-style text. Text and JSON uploads go through the sanitize step before analysis; EVTX files don’t yet. If your logs are in some other shape, there’s almost always a one-line command that converts them. The common ones are listed below.
LogTotal is SOC Prime’s free service for running detection logic against a log file without setting anything up: upload, sanitize, review. Getting the format right is the only part that can trip you up, so this page is the short version.
What LogTotal reads today
| Format | Typical sources | Sanitized before analysis? | How to get it |
|---|---|---|---|
| EVTX | Windows Security, System, Sysmon, PowerShell, Defender, DNS Server | Not yet | [EVTX export guide], [Sysmon], [PowerShell] |
| JSON / JSON lines | CloudTrail, Entra ID, Microsoft 365, Google Cloud, Okta, Workspace, Kubernetes audit, journalctl -o json, SIEM API exports | Yes | [CloudTrail], [Entra ID], [journalctl], [Sentinel] |
| Syslog-style text | auth.log and secure, Splunk raw exports, QRadar payloads, firewall syslog | Yes | [sshd logs], [Splunk], [QRadar] |
| CSV | Entra ID sign-in/audit downloads, Microsoft 365 audit log exports, Google Workspace audit exports, Splunk / Sentinel / Kibana search results, Event Viewer “Save as CSV” | Yes | [Entra ID CSV], [M365 audit export], [Splunk CSV], [Event Viewer CSV] |
Getting JSON right
One event per line is the safest shape. Many tools wrap events in arrays or envelopes. Flatten them before uploading:
| You have | Flatten with |
|---|---|
| A JSON array (gcloud, az, many APIs) | jq -c ‘.[]’ in.json > out.jsonl |
| CloudTrail log files | jq -c ‘.Records[]’ *.json > out.jsonl |
| aws cloudtrail lookup-events output | jq -c ‘.Events[].CloudTrailEvent | fromjson’ in.json > out.jsonl |
| CloudWatch Logs events | jq -c ‘.events[].message | fromjson’ in.json > out.jsonl |
| Splunk REST JSON export | jq -c ‘select(.result) | .result’ in.json > out.jsonl |
Watch the encoding on Windows. Windows PowerShell 5.1 writes UTF-16 when you use > or Out-File without options. Add -Encoding utf8, as every PowerShell example in our guides does.
Keep the time zone. ISO 8601 timestamps with Z or an offset make findings line up with other sources. Classic syslog timestamps have no year and no zone; note the source’s time zone when you upload them.
Converting what LogTotal doesn’t read
| You have | Convert with |
|---|---|
| systemd journal files (.journal) | journalctl -D <dir> -o json –no-pager > out.jsonl |
| A macOS .logarchive | log show –archive <file> –style json > out.json (on a Mac) |
| EVTX, but you want the sanitize step | evtx_dump -o jsonl in.evtx > out.jsonl |
| Gzipped logs | zcat -f in.log.gz > out.log |
| A spreadsheet or XML export from a SIEM’s web interface | Re-export through the platform’s API or CLI; see |
Size
split -l 200000 big.jsonl part_
For EVTX, filter while exporting with wevtutil /q
FAQ
Does LogTotal keep my files?
No. Uploads are analyzed and not retained.
Will more formats be supported?
Yes. We add formats regularly, and this page always lists what works today.
