topic Re: splunk Add-on for windows 8.8.0 has renaming of sourcetype to lower case xmlwineventlog and wineventlog in Splunk Cloud Platform

splunk Add-on for windows 8.8.0 has renaming of sourcetype to lower case xmlwineventlog and wineventlog

lavs — Thu, 13 Feb 2025 19:06:20 GMT

splunk Add-on for windows 8.8.0 has renaming of sourcetype to lower case xmlwineventlog and wineventlog

is this normal because I am familiar with using XmlWinEventLog & WinEventLog formatted sourcetype.

Re: splunk Add-on for windows 8.8.0 has renaming of sourcetype to lower case xmlwineventlog and wineventlog

livehybrid — Thu, 13 Feb 2025 19:10:03 GMT

Yes, it's normal for the Splunk Add-on for Windows (version 8.8.0) to use lowercase representations for sourcetypes such as `xmlwineventlog` and `wineventlog`. This change is consistent with other sorcetypes in Splunk, with better consistency.

In your experience with `XmlWinEventLog` and `WinEventLog`, these sourcetypes have simply been renamed for this version of the add-on. If you are transitioning from older versions or have existing configurations that reference the previous sourcetype names, these should still work fine as values in SPL are not case sensitive.

If you run into any issues with the new sourcetypes, feel free to reach out for help with querying, dashboard creation, or other operational aspects related to this change.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: splunk Add-on for windows 8.8.0 has renaming of sourcetype to lower case xmlwineventlog and wineventlog

lavs — Thu, 13 Feb 2025 19:23:41 GMT

another question , these lowercase sourcetype are creating multiple sourcetypes in splunk . The latest TA that I downloaded from splunkbase has XmlWinEventLog & WinEventLog only sourcetype . We want to just use this as multiple different format are creating issue for detection cases. I was going to upgrade this app because the latest version of app has XmlWinEventLog & WinEventLog. will this create issue ?i don't think so but checking .