All Apps and Add-ons

Windows logs: switch from xml format to legacy one

SplunkExplorer
Contributor

Hi Splunkers, in our environment we are collecting Microsoft Windows logs that, currently, come in xml format. Customer demand us to switch off xml: on Splunk Console, he want to see logs in legacy/traditional format and not xml one.
I don't remember how this can be achieved; am I wrong or I have to change a parameter in addon configuration? By the way, those are essential data for our scenario:

  • Collection mode: UF installed on each Windows data sources. Logs are sent to an HF and then to a Splunk SaaS, so final flow is: log sources (with UF) -> HF -> Splunk SaaS (both Core and ES).
  • UF management: all UF are managed with a Deployment Server
  • Addon used: the "classic" one, https://splunkbase.splunk.com/app/742 
  • Addon installation: on both SaaS env and HF
Labels (2)
0 Karma
1 Solution

tej57
Communicator

Hello @SplunkExplorer,

You can switch off the xml mode event logs using the following configuration in inputs.conf in the Splunk Add-on for Microsoft Windows.

[WinEventLog://Application]
renderXml = false

[WinEventLog://Security]
renderXml = false

 

---

If the above solution is helpful, an upvote is appreciated.

 

View solution in original post

tej57
Communicator

Hey @SplunkExplorer,

It seems that a few hosts are sending in classical text format and not in XML format. And yes, you can run the btool command to identify the parameter setting. Below is the btool command for your reference:

$SPLUNK_HOME/bin/splunk btool inputs list WinEventLog://Security --debug | grep renderXml

 

tej57
Communicator

Hello @SplunkExplorer,

You can switch off the xml mode event logs using the following configuration in inputs.conf in the Splunk Add-on for Microsoft Windows.

[WinEventLog://Application]
renderXml = false

[WinEventLog://Security]
renderXml = false

 

---

If the above solution is helpful, an upvote is appreciated.

 

SplunkExplorer
Contributor

Hi @tej57 , thanks a lot, you are right, searched parameter is there. 

I noted a strange behavior and I don't now if you can help me on this: I noted that, before change the parameter, if I search on out Splunk, events are most but not all in xml format:

SplunkExplorer_0-1701169528460.png

That seems strange because, analyzing the inputs.conf on addon, all stanza has the parameter equals to true; so, how can be possible this? My suspect is that, in another inpust.conf or .conf file, that parameter is set to true. 
How can I check this? May be usying the btool utility?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...