topic Re: Cannot parse linux logs in Getting Data In

Cannot parse linux logs

meg — Fri, 27 Jun 2025 11:54:33 GMT

My linux logs cannot parsed in dashboard. My renderxml is setted to false

Re: Cannot parse linux logs

kiran_panchavat — Fri, 27 Jun 2025 12:33:03 GMT

renderXml = false

This setting is typically used in Universal Forwarder or inputs.conf for Windows Event Logs. If you're forwarding Linux logs, this setting might not be relevant unless you're using it in a specific context.

Have you installed the below add-on to parse the data? Can you share your inputs.conf file here.

https://splunkbase.splunk.com/app/6652

https://docs.splunk.com/Documentation/AddOns/released/NixSysmon/Sourcetypes

Re: Cannot parse linux logs

kiran_panchavat — Fri, 27 Jun 2025 12:34:27 GMT

@meg Please verify your sourcetype, The Splunk Add-on for Sysmon for Linux supports the following source types:

sysmon:linux

Re: Cannot parse linux logs

livehybrid — Fri, 27 Jun 2025 13:40:33 GMT

Hi @meg

Please can you confirm the sourcetype that you are using?

Also, is this being read directly using a UF and sent to Splunk without going via other systems?

Are you ingesting this using the Splunk Add-on for Sysmon for Linux on the UF?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing