Windows xml and non-xml format difference- Am I getting duplicate raw event?

FJOMAA — Wed, 28 Sep 2022 17:59:39 GMT

Hello,

i'm currently ingesting XML and non-xml windows event logs,

i wanna know the impact if i disable the render xml in my UF,

i wanna know also if i'am getting duplicated raw event if im rendering xml data (non-xml and xml are being ingested together ? )

if the answer is yes and if i disable the xml format do i get some data loss ? (because i get some event id that being ingested only in xml format).

Re: Windows xml and non-xml format differance

richgalloway — Wed, 28 Sep 2022 13:17:51 GMT

AIUI, events will be sent in either XML or non-XML format, but not both. If you disable XML then the event will be sent in non-XML format. If you disable the input then events will not be sent at all (data loss).

topic Windows xml and non-xml format difference- Am I getting duplicate raw event? in Getting Data In

Windows xml and non-xml format difference- Am I getting duplicate raw event?

Re: Windows xml and non-xml format differance