I cannot seem to get LEM to read the .evtx file that Netapp is generating.
This postNetapp Clustered Data ONTAP CIFS auditing to LEM has been answered but in the same post at a later date is this statement
We have had a customer report that something changed in NetApp's auditing (or certain firmwares are different?) and this method we're using (remote event log collection) may not work. If you're able to use Computer Management to remotely connect to the NetApp device's event log, our method will work. If all you have access to is a bare evtx on a file share, it may not work. We're still researching what/why/how on that issue and don't know how widespread it is.
All I have is the bare evtx file. I validated that information in this file is what I want, I just can't get the LEM to read it. I created a connector on a Windows machine that has access to this file and I put in the correct unc path. The connector starts up and is Green but no data so far.