topic How to filter xml logs from wineventlog? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-filter-xml-logs-from-wineventlog/m-p/597621#M208076 <P>I want to filter eventcode 4624 and user_type=computer using transforms and props.conf</P> <P>Transforms.conf</P> <P>[setnule]<BR />REGEX = \&lt;EventID\&gt;4624\&lt;\/EventID\&gt;.+\&lt;Data\s+Name='WorkStationName'&gt;<BR />DEST_KEY = queue<BR />FORMAT = nullQueue</P> <P>props.conf</P> <P>[XmlWinEventLog]<BR />TRANSFORMS-set=setnule</P> Thu, 12 May 2022 16:28:30 GMT mjemi 2022-05-12T16:28:30Z How to filter xml logs from wineventlog? https://community.splunk.com/t5/Splunk-Search/How-to-filter-xml-logs-from-wineventlog/m-p/597621#M208076 <P>I want to filter eventcode 4624 and user_type=computer using transforms and props.conf</P> <P>Transforms.conf</P> <P>[setnule]<BR />REGEX = \&lt;EventID\&gt;4624\&lt;\/EventID\&gt;.+\&lt;Data\s+Name='WorkStationName'&gt;<BR />DEST_KEY = queue<BR />FORMAT = nullQueue</P> <P>props.conf</P> <P>[XmlWinEventLog]<BR />TRANSFORMS-set=setnule</P> Thu, 12 May 2022 16:28:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-xml-logs-from-wineventlog/m-p/597621#M208076 mjemi 2022-05-12T16:28:30Z