topic Re: WinEventLogs Cannot get Event Details in Getting Data In

WinEventLogs Cannot get Event Details

nabeel652 — Tue, 29 Sep 2020 14:24:08 GMT

I am monitoring WinEventLogs for Direct Access Troubleshooting using stanzas like:

[WinEventLog://Microsoft-Windows-Base-Filtering-Engine-Connections/Operational]
disabled = 0
index = myindex

I am successfully getting all events but the information I can see in Windows Event Viewer's Details tab is not received. The information in the logs in Splunk is pretty basic and almost useless.

I've uploaded two screenshots. DA_Logs shows what I am getting using the above stanza whereas DA_Logs2 is the what I actually need under "Details" tab from the Event Viewer.

Re: WinEventLogs Cannot get Event Details

ddrillic — Thu, 08 Jun 2017 20:51:04 GMT

Maybe the following can help - Monitor Windows event log data

Re: WinEventLogs Cannot get Event Details

Richfez — Fri, 09 Jun 2017 00:09:11 GMT

The fields and values under the "Details" section of the Windows Event is actually what Windows would send if you set renderXml = 1 on. What you get when you either have renderXml = 0 (or if the setting just isn't in there) is the information under the "General" tab.

Normally these two sets of information are the same or at least very similar, but not always. It will always show different in field names and such, but that's to be expected since half of the non-xml events don't have field names properly anyway. In some cases the actual information is completely different.

My guess is this is what you are seeing. To fix, edit your input stanza and add to it:

[WinEventLog://Microsoft-Windows-Base-Filtering-Engine-Connections/Operational]
renderXml = 1
disabled = 0
index = myindex

After that (well, and appropriate UF restarts and whatnot) your events will come in looking as ugly as sin, BUT the fields will be far better and more usefully named and will have better content most of the time.

So, I'd recommend after the above change that you shorten your time frame, run it in verbose mode and exploring the new fields (rather than looking at and going blind from the raw XML).