topic Re: Changing from XML format to "Normal" format. in Getting Data In

How to change from XML format to "Normal" format?

jamie1 — Fri, 31 Mar 2023 16:38:30 GMT

Hi there,

Before installing the Windows TA addon to a server , Windows Event Logs were shown in a different format, they are now shown in XML. I want to see searches in the original format.

I have checked the inputs.conf file and noticed "renderXml=true", I changed this to "renderXml=false" but it hasn't made a difference.

Any help would be appreciated.

Jamie

Re: Changing from XML format to "Normal" format.

gcusello — Fri, 31 Mar 2023 14:54:31 GMT

Hi @jamie1,

add

renderXml = False

to your inputs.conf stanzas.

For more infos, see at https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Inputsconf

renderXml = <boolean> * Whether or not the input returns the event data in XML (eXtensible Markup Language) format or in plain text. * Set this to "true" to render events in XML. * Set this to "false" to output events in plain text. * If you set this setting to "true", you should also set the 'suppress_text', 'suppress_sourcename', 'suppress_keywords', 'suppress_task', and 'suppress_opcode' settings to "true" to improve thruput performance. * Default: false

Ciao.

Giuseppe

Re: Changing from XML format to "Normal" format.

jamie1 — Fri, 31 Mar 2023 15:01:39 GMT

Hi Giuseppe,

I have added this line to the stanzas within the UF inputs.conf and the Windows TA inputs.conf and it doesn't seem to have worked.

Re: Changing from XML format to "Normal" format.

gcusello — Fri, 31 Mar 2023 15:08:45 GMT

Hi @jamie1,

then try :

renderXml = false

then, a very stupid question (only to cancel every possible error!): obviously you restarted Splunk on the UF after update.

Ciao.

Giuseppe

Re: Changing from XML format to "Normal" format.

jamie1 — Fri, 31 Mar 2023 15:14:41 GMT

Hi @gcusello,

Switching to lowercase and spacing the words between the = fixed it.

Thanks for your help 🙂

Jamie

Re: Changing from XML format to "Normal" format.

gcusello — Fri, 31 Mar 2023 15:42:12 GMT

Hi @jamie1,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉