All Apps and Add-ons

Splunk Add-On for Microsoft Sysmon: Is XML preferred or recommended?

bobsim
New Member

Questions in the inputs.conf

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = true
renderXml = 1

I see the default is to disable XML however there are vague references to XM in the doc.   I saw it source types it to XML in the next line.

source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

Are both types possible and is XML preferred or recommended?  I was looking for some advice and didn't see any in the doc. 

Thank you.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...