Cannot parse linux logs

[meg]

My linux logs cannot parsed in dashboard. My renderxml is setted to false

[livehybrid]

Hi @meg 

Please can you confirm the sourcetype that you are using?

Also, is this being read directly using a UF and sent to Splunk without going via other systems? 

Are you ingesting this using the Splunk Add-on for Sysmon for Linux on the UF?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@meg Please verify your sourcetype, The Splunk Add-on for Sysmon for Linux supports the following source types:

sysmon:linux 

[kiran_panchavat]

@meg 

renderXml = false

This setting is typically used in Universal Forwarder or inputs.conf for Windows Event Logs. If you're forwarding Linux logs, this setting might not be relevant unless you're using it in a specific context.

Have you installed the below add-on to parse the data? Can you share your inputs.conf file here. 

https://splunkbase.splunk.com/app/6652 

https://docs.splunk.com/Documentation/AddOns/released/NixSysmon/Sourcetypes