https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-format-of-Windows-Event-Log-in-order-to-forward/m-p/243003#M47094 <P>Hi , <BR /> For some reason , I must forward the Windows Event Log to our syslog server. <BR /> I configured the indexer server as document described, and it works successfully :<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Forwarddatatothird-partysystemsd">http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Forwarddatatothird-partysystemsd</A><BR /> ( The "Forward syslog data to a third-party host" part )</P> <P>But I don't know how to parse the Windows Event Log that Splunk forwarded to me.<BR /> The attached screenshot is the example log I opened with "Sublime" ( Text Editor ).<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2338i803CDD84E0AF061A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>It looks like Splunk converted the multi-line logs to single lines, and uses some special characters to format the log.<BR /> Anyone familiar with this format? How to parse it?</P> <P>OR what does the character "NUL" exactly mean? and I notice there is a number ( usually 012 , 015 ) follow by this character , I guess they have special meanings ( like \t , \n ... or some control characters.)</P> Thu, 19 Jan 2017 02:58:12 GMT leo_wang 2017-01-19T02:58:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-format-of-Windows-Event-Log-in-order-to-forward/m-p/243003#M47094 <P>Hi , <BR /> For some reason , I must forward the Windows Event Log to our syslog server. <BR /> I configured the indexer server as document described, and it works successfully :<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Forwarddatatothird-partysystemsd">http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Forwarddatatothird-partysystemsd</A><BR /> ( The "Forward syslog data to a third-party host" part )</P> <P>But I don't know how to parse the Windows Event Log that Splunk forwarded to me.<BR /> The attached screenshot is the example log I opened with "Sublime" ( Text Editor ).<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2338i803CDD84E0AF061A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>It looks like Splunk converted the multi-line logs to single lines, and uses some special characters to format the log.<BR /> Anyone familiar with this format? How to parse it?</P> <P>OR what does the character "NUL" exactly mean? and I notice there is a number ( usually 012 , 015 ) follow by this character , I guess they have special meanings ( like \t , \n ... or some control characters.)</P> Thu, 19 Jan 2017 02:58:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-format-of-Windows-Event-Log-in-order-to-forward/m-p/243003#M47094 leo_wang 2017-01-19T02:58:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-format-of-Windows-Event-Log-in-order-to-forward/m-p/243004#M47095 <P>theres an option to sendCookedData in outputs.conf. You want to set that to false.</P> Thu, 19 Jan 2017 03:22:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-the-format-of-Windows-Event-Log-in-order-to-forward/m-p/243004#M47095 jkat54 2017-01-19T03:22:06Z