Windows logs: switch from xml format to legacy one

[SplunkExplorer]

Hi Splunkers, in our environment we are collecting Microsoft Windows logs that, currently, come in xml format. Customer demand us to switch off xml: on Splunk Console, he want to see logs in legacy/traditional format and not xml one.
I don't remember how this can be achieved; am I wrong or I have to change a parameter in addon configuration? By the way, those are essential data for our scenario:

• Collection mode: UF installed on each Windows data sources. Logs are sent to an HF and then to a Splunk SaaS, so final flow is: log sources (with UF) -> HF -> Splunk SaaS (both Core and ES).
• UF management: all UF are managed with a Deployment Server
• Addon used: the "classic" one, https://splunkbase.splunk.com/app/742 
• Addon installation: on both SaaS env and HF

[tej57]

Hey @SplunkExplorer,

It seems that a few hosts are sending in classical text format and not in XML format. And yes, you can run the btool command to identify the parameter setting. Below is the btool command for your reference:

$SPLUNK_HOME/bin/splunk btool inputs list WinEventLog://Security --debug | grep renderXml

[tej57 · Accepted solution]

Hello @SplunkExplorer,

You can switch off the xml mode event logs using the following configuration in inputs.conf in the Splunk Add-on for Microsoft Windows.

[WinEventLog://Application]
renderXml = false

[WinEventLog://Security]
renderXml = false

---

If the above solution is helpful, an upvote is appreciated.

[SplunkExplorer]

Hi @tej57 , thanks a lot, you are right, searched parameter is there. 

I noted a strange behavior and I don't now if you can help me on this: I noted that, before change the parameter, if I search on out Splunk, events are most but not all in xml format:

That seems strange because, analyzing the inputs.conf on addon, all stanza has the parameter equals to true; so, how can be possible this? My suspect is that, in another inpust.conf or .conf file, that parameter is set to true. 
How can I check this? May be usying the btool utility?