When using Splunk App for Windows Infrastructure, do you have any recommendations for non-English Windows server logs?

[aroos]

Hello there,

Official documentation states

Microsoft Windows event logs that are rendered in XML format will not populate in the Splunk App for Windows Infrastructure

and props.conf makes regex on english sentences:

 [source::WinEventLog:Security]
EXTRACT-4625-fields = (?ms)EventCode=4625.*?Message=.*?\n.*?Subject\s*:.*?Account Name:\s*(?.*?)\n.*?Account  Domain:\s*(?.*?)\n.*?Logon ID:\s*(?.*?)\n.*?\nLogon Type:.*?\n.*?Account For Which Logon Failed.*?\n.*?Security ID:(?.*?)\n.*?Account Name:(?.*?)\n.*?Account Domain:(?.*?)\n
EXTRACT-4624-srcip = (?ms)EventCode=4624\n.*?Source Network Address:\s+?(?[^\n]+)
EXTRACT-4624-user = (?ms)New Logon:\n*?.*?Security ID:\s*?(?[^\\]+)\\(?.*?)\n.*?Account Name:(?.*?)\s*\n.*?Account Domain:\s+(?[^\n]+).*?Logon ID:\s+(?[^\n]+)

...

How do I deal with non-English Windows event logs? i didn't see any language requirements in documentation.

Thx
Anthony