Dashboards & Visualizations

How do you add new field extraction and do proper line breaking? (Sourcetype=XMLWinEventLog)

Path Finder

An example of my raw text is attached. How do I do the field extraction and also proper line breaking in event logs like this? I've changed renderXml to true so as to reduce the resource intensity. the sourcetype is XmlWinEventLog

alt text

0 Karma
1 Solution

Path Finder

Question resolved, I changed renderXml to false and proceed using regex (example: rex in splunk) to actually extract fields, this way its much more efficient. In my opinion.

View solution in original post

0 Karma

Path Finder

Question resolved, I changed renderXml to false and proceed using regex (example: rex in splunk) to actually extract fields, this way its much more efficient. In my opinion.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi @Kitteh,

You can install SplunkTAWindows add-on (https://splunkbase.splunk.com/app/742/) to extract fields during search time.

Thanks,
Harshil

0 Karma

SplunkTrust
SplunkTrust

Hi @Kitteh,

Is this sysmon data?

Thanks,
Harshil

0 Karma

Path Finder

Hi @harsmarvania57,

No this is not Sysmon data. Particularly on Windows Event Viewer log on application, system and security.

Regards,
Kitteh

0 Karma