XmlWinEventLog:ForwardedEvents sourcetype field extraction issue

tech_g706 — Fri, 22 Aug 2025 10:30:57 GMT

Hi,

I’m currently receiving Windows logs in Splunk via the (UF → HF → Splunk Cloud). The logs are being assigned to two sourcetypes:

XmlWinEventLog
XmlWinEventLog:ForwardedEvents

For the XmlWinEventLog sourcetype, field extractions are working correctly. However, for the XmlWinEventLog:ForwardedEvents sourcetype, no field extractions are being applied, even though the log format appears to be the same.

Since I am not very familiar with the XmlWinEventLog:ForwardedEvents sourcetype, I would like guidance on how to configure the Heavy Forwarder so that it applies the same field extractions used by XmlWinEventLog to XmlWinEventLog:ForwardedEvents.

Thank you for your support.

Re: XmlWinEventLog:ForwardedEvents sourcetype field extraction issue

richgalloway — Fri, 22 Aug 2025 14:21:21 GMT

To ensure proper processing of data, EVERY sourcetype should have settings in a props.conf file. This keeps Splunk from having to guess about the data and improves onboarding performance.

If data with the XmlWinEventLog:ForwardedEvents sourcetype looks similar to data with the XmlWinEventLog sourcetype then it's a simple matter of copying the XmlWinEventLog stanza in props.conf to create a XmlWinEventLog:ForwardedEvents stanza.

topic XmlWinEventLog:ForwardedEvents sourcetype field extraction issue in Getting Data In

XmlWinEventLog:ForwardedEvents sourcetype field extraction issue

Re: XmlWinEventLog:ForwardedEvents sourcetype field extraction issue