topic Re: Ingest Action XmlWinEventLog Sourcetype Sample in Splunk Search

Has anyone been able to figure out how to search indexed XmlWinEventLog sourcetype sample logs in the Ingest Action GUI?

tjones130 — Thu, 11 May 2023 02:00:01 GMT

Has anyone been able to figure out how to search indexed XmlWinEventLog sourcetype sample logs in the Ingest Action GUI? The actual search being used uses the |where command which seems to be the issue.

index=* OR index=_* sourcetype="XmlWinEventLog"
| where sourcetype="XmlWinEventLog"
| head 100

Re: Ingest Action XmlWinEventLog Sourcetype Sample

ITWhisperer — Wed, 10 May 2023 13:26:44 GMT

where is case-sensitive, search is not. Check the exact spelling and case of the sourcetype you are searching for.

Re: Ingest Action XmlWinEventLog Sourcetype Sample

tjones130 — Wed, 10 May 2023 13:46:15 GMT

I have tried multiple variations of case-sensitivity, with no luck. The sourcetype that returns when running index=* sourcetype="XmlWinEventLog" is "XmlWinEventLog".

Re: Has anyone been able to figure out how to search indexed XmlWinEventLog sourcetype sample logs in the Ingest Action

fjiang — Thu, 25 Jul 2024 21:47:50 GMT

Hi there!

This was published as a known issue first in 9.0.2: https://docs.splunk.com/Documentation/Splunk/9.0.2/ReleaseNotes/KnownIssues

See the entry for SPL-235416.

The preview UI in Ingest Actions has since been fixed in:
Splunk Enterprise version 9.0.5+
Splunk Cloud Platform version 9.0.2303+