Duplicate EventCode when using Splunk Add-on for Windows

[Na_Kang_Lim]

Splunk Add-on for Windows is well-known and I am using it to parse my XmlWinEventLog. However, upon using, I am getting EventCode as a duplicated codes in multiline, like this:

4688
4688

I think I could find the reason, as in the transforms.conf, there are 2 function for detecting EventCode:

[EventID_as_EventCode]
SOURCE_KEY = EventID
REGEX = (.+)
FORMAT = EventCode::$1

[EventID2_as_EventCode]
REGEX = <EventID.*?>(.+?)<\/EventID>.*
FORMAT = EventCode::$1

And in the props.conf, both function is called:

REPORT-EventCode_from_xml = EventID_as_EventCode, EventID2_as_EventCode

However, I have never seen someone mentioned this issue, so is this because of my log? My log is the XML WinEventLog like this:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='Microsoft-Windows-Security-Auditing'
            Guid='{68ad733a-0b7e-4010-a246-bad643c2e4c1}' />
        <EventID>4688</EventID>
        <Version>2</Version>
        <Level>0</Level>
        <Task>13312</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8020000000000000</Keywords>
        <TimeCreated SystemTime='2025-05-30T10:55:19.179279400Z' />
        <EventRecordID>25849216</EventRecordID>
        <Correlation />
        <Execution ProcessID='4' ThreadID='7780' />
        <Channel>Security</Channel>
        <Computer>ABCD-DE01.company.domain</Computer>
        <Security />
    </System>
    <EventData>
        <Data Name='SubjectUserSid'>S-1-5-18</Data>
        <Data Name='SubjectUserName'>ABCD-DE01$</Data>
        <Data Name='SubjectDomainName'>COMPANY.DOMAIN</Data>
        <Data Name='SubjectLogonId'>0x3e7</Data>
        <Data Name='NewProcessId'>0x1c48</Data>
        <Data Name='NewProcessName'>C:\Windows\System32\net1.exe</Data>
        <Data Name='TokenElevationType'>%%1936</Data>
        <Data Name='ProcessId'>0x2a2c</Data>
        <Data Name='CommandLine'>C:\Windows\system32\net1 accounts</Data>
        <Data Name='TargetUserSid'>S-1-0-0</Data>
        <Data Name='TargetUserName'>-</Data>
        <Data Name='TargetDomainName'>-</Data>
        <Data Name='TargetLogonId'>0x0</Data>
        <Data Name='ParentProcessName'>C:\Windows\System32\net.exe</Data>
        <Data Name='MandatoryLabel'>S-1-16-16384</Data>
    </EventData>
</Event>

 The result of this is that the functions called below, using EventCode, cannot match the EventCode, like this one:

EVAL-process_name = if(EventCode=4688, New_Process_Name, Process_Name)

[gcusello]

Hi @Na_Kang_Lim ,

I hadn't noticed the problem, but in any case, since it's an add-on maintained by Splunk, open a case with Splunk Support.

Ciao.

Giuseppe