WinEventLog vs XmlWinEventLog

thebankitgui — Thu, 18 Jan 2024 15:47:31 GMT

Good Morning,

I am running into an issue where my two newest Server 2022 endpoints have events that are showing up non-XML, whereas all my other endpoints are outputting in XML. I have renderXml=true in the inputs.conf and the inputs.conf files in the Splunk_TA_windows are the same for each endpoint. I can't find the difference causing this.

One thing I have learned through this is that I may prefer non-XML so if these two endpoints are not respecting renderXml=true, how do I know all the others will respect the false value to match them all up? Is there somewhere overriding this? I have not edited any \etc\system\default\inputs.conf files. They're all in local or an app.

Thank you in advance!

Edit: I am on Splunk Cloud.

Scott

Re: WinEventLog vs XmlWinEventLog

mmccul — Thu, 08 Feb 2024 04:39:57 GMT

First thing to check is of course btool

splunk btool inputs list --debug

for the respective inputs. If it shows renderXml set to false, for those inputs, then some other setting is overriding the setting you are trying to apply. Adding the --debug flag lets you know which file provides the winning setting, so you can figure out where it is coming from.

topic Re: WinEventLog vs XmlWinEventLog in Getting Data In

WinEventLog vs XmlWinEventLog

Re: WinEventLog vs XmlWinEventLog