topic Re: Sysmon logs appear as binary/hex in Splunk how to fix? in Dashboards & Visualizations

Sysmon logs appear as binary/hex in Splunk how to fix?

bakeery — Wed, 18 Jun 2025 19:41:22 GMT

Hi all,

I’m using the Splunk Universal Forwarder on Windows to collect event logs. My inputs.conf includes the following configurations:

[WinEventLog://Security] disabled = 0 index = win_log [WinEventLog://System] disabled = 0 index = win_log [WinEventLog://Application] disabled = 0 index = win_log [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = 0 renderXml = true index = win_log

The first three (Security, System, and Application) work perfectly and show readable, structured logs.

However, when I run:

index=win_log sourcetype=*sysmon*

I get logs in unreadable binary or hex format like:

\x00\x00**\x00\x00 \x00\x00@\x00\x00\x00\x00\x00\x00\xCE....

How can I fix this and get properly parsed Sysmon logs (with fields like CommandLine, ParentProcess, etc.)?

Re: Sysmon logs appear as binary/hex in Splunk how to fix?

PickleRick — Wed, 18 Jun 2025 20:26:37 GMT

It is highly improbable that the eventlog input mangles the events. I'd rather suspect that it's being ingested some different way. Since there is a UTF-16-encoded text there I'd suspect that apart from ingesting data from event log you're somehow trying to read the raw evtx file.

Or you've hit some bug in the UF.

Re: Sysmon logs appear as binary/hex in Splunk how to fix?

livehybrid — Wed, 18 Jun 2025 21:24:52 GMT

Hi @bakeery

Please can you confirm which UF version you are running on? There is a known issue (SPL-217199) in < 9.0.1 relating to WinEventLog sourcetype having encoded broken fields appended and I'm wondering if this could be related?

See https://splunk.my.site.com/customer/s/article/Special-characters-in-sourcetype-for-windows-data-in-UF for more info.

If you are on <9.0.1 I would recommend upgrading to see if this resolves the issue.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Sysmon logs appear as binary/hex in Splunk how to fix?

PrewinThomas — Thu, 19 Jun 2025 06:14:30 GMT

@bakeery

Are you using sysmon add-on?

#https://splunkbase.splunk.com/app/5709

Also refer below #https://community.splunk.com/t5/Getting-Data-In/Why-isn-t-the-Sysmon-Technology-Add-on-Parsing-my-Sysmon-Logs/m-p/370757

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Sysmon logs appear as binary/hex in Splunk how to fix?

bakeery — Thu, 19 Jun 2025 07:44:25 GMT

Thank you for your reply. I am using Splunk 9.4.2 which is the latest version as of now.

Re: Sysmon logs appear as binary/hex in Splunk how to fix?

bakeery — Thu, 19 Jun 2025 07:46:53 GMT

No, I am not using a Splunk add-on I am using the Splunk forwarder to send the logs