https://community.splunk.com/t5/Getting-Data-In/Windows-platforms-italian-language/m-p/115150#M24110 <P>Remigio,<BR /> the "problem" is fields definition. Fields in Splunk can either discoveder automatically by Splunk by default on a syntax like "string=value", or you can simply define them using regex. Field extractions are based on the "sourcetype", that is the "kind" of log data you're analyzing. </P> <P>Pre defined sourcetype, like WinEventLog:* rely on english default language to recognize fields. So, you should enhance this by defining new fields extraction for the WinEventLog:* sourcetypes using the string in Italian.</P> <P>More about defining fields extractions can be found here: <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Managesearch-timefieldextractions">http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Managesearch-timefieldextractions</A></P> <P>Regards,<BR /> Marco Scal</P> Thu, 06 Mar 2014 13:23:34 GMT marcoscala 2014-03-06T13:23:34Z https://community.splunk.com/t5/Getting-Data-In/Windows-platforms-italian-language/m-p/115149#M24109 <P>Hi, I'm beginner about this product and I ask for help.<BR /> I installed the package "splunkforwarder-6.0.1-189883-x86-release.msi" <BR /> on Windows ENU language and all EventLog are forwarded and parsed correctly so I may build reports/dashboard.</P> <P>I've installed the same package on Windows ITALIAN version. <BR /> The Event Log are forwarded but not parsed correctly.</P> <P>This is the begin of original message: <BR /> Message=Accesso alla rete riuscito:<BR /> Nome utente: Administrator<BR /> Dominio: W2K3ITA<BR /> ID accesso: (0x0,0x1738E4)<BR /> Tipo accesso: 2<BR /> Processo di accesso: User32<BR /><BR /> .....<BR /> .....</P> <P>I think may be a localized language problem.</P> <P>Can someone help me?</P> Wed, 15 Jan 2014 14:34:06 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-platforms-italian-language/m-p/115149#M24109 RemigioGastaldo 2014-01-15T14:34:06Z https://community.splunk.com/t5/Getting-Data-In/Windows-platforms-italian-language/m-p/115150#M24110 <P>Remigio,<BR /> the "problem" is fields definition. Fields in Splunk can either discoveder automatically by Splunk by default on a syntax like "string=value", or you can simply define them using regex. Field extractions are based on the "sourcetype", that is the "kind" of log data you're analyzing. </P> <P>Pre defined sourcetype, like WinEventLog:* rely on english default language to recognize fields. So, you should enhance this by defining new fields extraction for the WinEventLog:* sourcetypes using the string in Italian.</P> <P>More about defining fields extractions can be found here: <A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Managesearch-timefieldextractions">http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Managesearch-timefieldextractions</A></P> <P>Regards,<BR /> Marco Scal</P> Thu, 06 Mar 2014 13:23:34 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-platforms-italian-language/m-p/115150#M24110 marcoscala 2014-03-06T13:23:34Z