How do you add new field extraction and do proper line breaking? (Sourcetype=XMLWinEventLog)

[Kitteh]

An example of my raw text is attached. How do I do the field extraction and also proper line breaking in event logs like this? I've changed renderXml to true so as to reduce the resource intensity. the sourcetype is XmlWinEventLog

[Kitteh · Accepted solution]

Question resolved, I changed renderXml to false and proceed using regex (example: rex in splunk) to actually extract fields, this way its much more efficient. In my opinion.

[harsmarvania57]

Hi @Kitteh,

You can install Splunk_TA_Windows add-on (https://splunkbase.splunk.com/app/742/) to extract fields during search time.

Thanks,
Harshil

[harsmarvania57]

Hi @Kitteh,

Is this sysmon data?

Thanks,
Harshil

[Kitteh]

Hi @harsmarvania57,

No this is not Sysmon data. Particularly on Windows Event Viewer log on application, system and security.

Regards,
Kitteh