https://community.splunk.com/t5/Getting-Data-In/Windows-event-logs-BSD-syslog-format/m-p/536941#M90002 <P>Hi all,</P><P>I am receiving Windows event logs from a domain controller via an NXLogs agent. This data is being sent over UDP/514 and the data format is in BSD style syslog.</P><P>Whilst I am successfully receiving and ingesting this data the problem I have is as follows</P><UL><LI>How do I have splunk successfully parse this data so that it can be used by the Windows TA addon</LI></UL><P>I am thinking I need to create something in the props.conf maybe?</P><P>Any questions please ask</P><P>Regards</P><P>TheTech</P> Sun, 24 Jan 2021 02:35:23 GMT thetech 2021-01-24T02:35:23Z https://community.splunk.com/t5/Getting-Data-In/Windows-event-logs-BSD-syslog-format/m-p/536941#M90002 <P>Hi all,</P><P>I am receiving Windows event logs from a domain controller via an NXLogs agent. This data is being sent over UDP/514 and the data format is in BSD style syslog.</P><P>Whilst I am successfully receiving and ingesting this data the problem I have is as follows</P><UL><LI>How do I have splunk successfully parse this data so that it can be used by the Windows TA addon</LI></UL><P>I am thinking I need to create something in the props.conf maybe?</P><P>Any questions please ask</P><P>Regards</P><P>TheTech</P> Sun, 24 Jan 2021 02:35:23 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-event-logs-BSD-syslog-format/m-p/536941#M90002 thetech 2021-01-24T02:35:23Z