"EventID" is not extracted when "Qualifiers" attribute is present

[rvany]

Splunk Enterprise: 9.0.3 (Linux)
Splunk Add-on for Microsoft Windows: 8.9.0
Data source: Windows Server 2016
Data format: XML

When extracting EventIDs from XML data the EventID is _not_ extracted if there's a "Qualifiers" attribute. Only the "Qualifiers" field is then extracted - see screenshot.

Is this intentionally?

[gcusello]

Hi @rvany ,

I don't know if this can solve your issue, but I found that using XML rendering not all the fields are correctly displayed, try using xmlRender=0 in inputs.conf.

Ciao.

Giuseppe

[rvany]

Thank you. Maybe that could be used as a workaround. I guess I have to to the extraction change/enhancement myself then 😉