Hello there,
Official documentation states
Microsoft Windows event logs that are rendered in XML format will not populate in the Splunk App for Windows Infrastructure
and props.conf makes regex on english sentences:
[source::WinEventLog:Security]
EXTRACT-4625-fields = (?ms)EventCode=4625.*?Message=.*?\n.*?Subject\s*:.*?Account Name:\s*(?.*?)\n.*?Account Domain:\s*(?.*?)\n.*?Logon ID:\s*(?.*?)\n.*?\nLogon Type:.*?\n.*?Account For Which Logon Failed.*?\n.*?Security ID:(?.*?)\n.*?Account Name:(?.*?)\n.*?Account Domain:(?.*?)\n
EXTRACT-4624-srcip = (?ms)EventCode=4624\n.*?Source Network Address:\s+?(?[^\n]+)
EXTRACT-4624-user = (?ms)New Logon:\n*?.*?Security ID:\s*?(?[^\\]+)\\(?.*?)\n.*?Account Name:(?.*?)\s*\n.*?Account Domain:\s+(?[^\n]+).*?Logon ID:\s+(?[^\n]+)
...
How do I deal with non-English Windows event logs? i didn't see any language requirements in documentation.
Thx
Anthony
