All Apps and Add-ons

Removing ffff from Splunk Windows Events log in XML format

amulay26
Path Finder

Am trying to remove ffff in the Windows events logs in XML format.The docs do mention about the SED Command to remove these values from Classic Format. However, there is not enough documentation on removing them from XML format.

So if I put SEDCMD-remove_ffff = s/(::ffff:)//g under [XmlWinEventLog:Security] in props.conf will it work? Or Although the logs are in XML format putting the same SEDCMD under [WinEventLog:Security] will work for XML events as well.

Inputs are appreciated.

1 Solution

woodcock
Esteemed Legend

If you are using anything below v6.0 of the TA, use this:
https://gist.github.com/automine/5c8ef5b50e1df38249dfba01a70f2875
If you are using v6.0 or higher, then look at the comments inside of props.conf and uncomment the lines that apply to your data.

View solution in original post

amulay26
Path Finder

Thank you for the assistance @woodcock and @skalliger

0 Karma

woodcock
Esteemed Legend

Be sure to come back and click Accept on the best answer to close the question (and maybe UpVote the others).

0 Karma

woodcock
Esteemed Legend

If you are using anything below v6.0 of the TA, use this:
https://gist.github.com/automine/5c8ef5b50e1df38249dfba01a70f2875
If you are using v6.0 or higher, then look at the comments inside of props.conf and uncomment the lines that apply to your data.

View solution in original post

skalliger
SplunkTrust
SplunkTrust

Hi,

I guess you're using the Windows TA because that add-on has the mentioned SEDCMD in its props.conf. For your XML format, you have to uncomment the line under [XmlWinEventLog:Security]. Please make sure to put that changd under a new ../local folder and don't modify the file in default.

Skalli

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.