Sysmon logs appear as binary/hex in Splunk how to fix?

[bakeery]

Hi all,

I’m using the Splunk Universal Forwarder on Windows to collect event logs. My inputs.conf includes the following configurations:

[WinEventLog://Security]
disabled = 0
index = win_log

[WinEventLog://System]
disabled = 0
index = win_log

[WinEventLog://Application]
disabled = 0
index = win_log

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = 0
renderXml = true
index = win_log

The first three (Security, System, and Application) work perfectly and show readable, structured logs.

However, when I run:

index=win_log sourcetype=*sysmon*

I get logs in unreadable binary or hex format like:

\x00\x00**\x00\x00 \x00\x00@\x00\x00\x00\x00\x00\x00\xCE....

 How can I fix this and get properly parsed Sysmon logs (with fields like CommandLine, ParentProcess, etc.)?

[PrewinThomas]

@bakeery 

Are you using sysmon add-on?

#https://splunkbase.splunk.com/app/5709

Also refer below #https://community.splunk.com/t5/Getting-Data-In/Why-isn-t-the-Sysmon-Technology-Add-on-Parsing-my-Sy...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[bakeery]

No, I am not using a Splunk add-on I am using the Splunk forwarder to send the logs

[livehybrid]

Hi @bakeery 

Please can you confirm which UF version you are running on? There is a known issue (SPL-217199) in < 9.0.1 relating to WinEventLog sourcetype having encoded broken fields appended and I'm wondering if this could be related? 

See https://splunk.my.site.com/customer/s/article/Special-characters-in-sourcetype-for-windows-data-in-U... for more info.

If you are on <9.0.1 I would recommend upgrading to see if this resolves the issue.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[bakeery]

Thank you for your reply. I am using Splunk 9.4.2 which is the latest version as of now.

[PickleRick]

It is highly improbable that the eventlog input mangles the events. I'd rather suspect that it's being ingested some different way. Since there is a UTF-16-encoded text there I'd suspect that apart from ingesting data from event log you're somehow trying to read the raw evtx file.

Or you've hit some bug in the UF.