All Apps and Add-ons

Windows logs: switch from xml format to legacy one

SplunkExplorer
Communicator

Hi Splunkers, in our environment we are collecting Microsoft Windows logs that, currently, come in xml format. Customer demand us to switch off xml: on Splunk Console, he want to see logs in legacy/traditional format and not xml one.
I don't remember how this can be achieved; am I wrong or I have to change a parameter in addon configuration? By the way, those are essential data for our scenario:

  • Collection mode: UF installed on each Windows data sources. Logs are sent to an HF and then to a Splunk SaaS, so final flow is: log sources (with UF) -> HF -> Splunk SaaS (both Core and ES).
  • UF management: all UF are managed with a Deployment Server
  • Addon used: the "classic" one, https://splunkbase.splunk.com/app/742 
  • Addon installation: on both SaaS env and HF
Labels (2)
0 Karma
1 Solution

tej57
Path Finder

Hello @SplunkExplorer,

You can switch off the xml mode event logs using the following configuration in inputs.conf in the Splunk Add-on for Microsoft Windows.

[WinEventLog://Application]
renderXml = false

[WinEventLog://Security]
renderXml = false

 

---

If the above solution is helpful, an upvote is appreciated.

 

View solution in original post

tej57
Path Finder

Hey @SplunkExplorer,

It seems that a few hosts are sending in classical text format and not in XML format. And yes, you can run the btool command to identify the parameter setting. Below is the btool command for your reference:

$SPLUNK_HOME/bin/splunk btool inputs list WinEventLog://Security --debug | grep renderXml

 

tej57
Path Finder

Hello @SplunkExplorer,

You can switch off the xml mode event logs using the following configuration in inputs.conf in the Splunk Add-on for Microsoft Windows.

[WinEventLog://Application]
renderXml = false

[WinEventLog://Security]
renderXml = false

 

---

If the above solution is helpful, an upvote is appreciated.

 

SplunkExplorer
Communicator

Hi @tej57 , thanks a lot, you are right, searched parameter is there. 

I noted a strange behavior and I don't now if you can help me on this: I noted that, before change the parameter, if I search on out Splunk, events are most but not all in xml format:

SplunkExplorer_0-1701169528460.png

That seems strange because, analyzing the inputs.conf on addon, all stanza has the parameter equals to true; so, how can be possible this? My suspect is that, in another inpust.conf or .conf file, that parameter is set to true. 
How can I check this? May be usying the btool utility?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...