Archive

Can you help me get fields in different languages to be displayed only in English?

jip31
Builder

Hi,

I have to query the event viewer, but some fields that are in bold are in different languages. What do I have to do in order to collect and to display them (| table _time host Type EventCode OpCode "File_Name" "Degradation_Time) in only one language (english)?

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Détérioration du démarrage" TaskCategory="Analyse des performances de démarrage" Nom_du_fichier=* "Durée de la dégradation"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Boot Degradation" TaskCategory="Boot Performance Monitoring" File_Name=* Degradation_Time=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Información del arranque" TaskCategory="Supervisión de rendimiento del arranque" "Duración del arranque"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Startbeeinträchtigung" TaskCategory="Systemstart-Leistungsüberwachung" Dateiname=Devi "Beeinträchtigungszeit"=*

Thanks for your help.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You should configure your inputs.conf to set renderXml = 1 this will force the logs to be collected in English only.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWindowseventlogdata#Display_events_in...

There is a note on that page: When you instruct Splunk Enterprise to render events in XML, event keys within the XML event render in English regardless of the machine system locale.

Good luck!

jip31
Builder

it's strange because renderXml is configurated like this....

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!