Removing ffff from Splunk Windows Events log in XML format

[amulay26]

Am trying to remove ffff in the Windows events logs in XML format.The docs do mention about the SED Command to remove these values from Classic Format. However, there is not enough documentation on removing them from XML format.

So if I put SEDCMD-remove_ffff = s/(::ffff:)//g under [XmlWinEventLog:Security] in props.conf will it work? Or Although the logs are in XML format putting the same SEDCMD under [WinEventLog:Security] will work for XML events as well.

Inputs are appreciated.

[amulay26]

Thank you for the assistance @woodcock and @skalliger

[woodcock]

Be sure to come back and click Accept on the best answer to close the question (and maybe UpVote the others).

[woodcock · Accepted solution]

If you are using anything below v6.0 of the TA, use this:
https://gist.github.com/automine/5c8ef5b50e1df38249dfba01a70f2875
If you are using v6.0 or higher, then look at the comments inside of props.conf and uncomment the lines that apply to your data.

[skalliger]

Hi,

I guess you're using the Windows TA because that add-on has the mentioned SEDCMD in its props.conf. For your XML format, you have to uncomment the line under [XmlWinEventLog:Security]. Please make sure to put that changd under a new ../local folder and don't modify the file in default.

Skalli