Getting Data In

Getting sourcetype as XMLWinEventLogs?

KulvinderSingh
Path Finder

Hi All,

trying to get WinEventlogs from SF to Indexer via HF. The logs are getting indexed but seems likes they are not getting parsed through TA as i am getting sourcetype as XMLWinEventLog instead or Wineventlog. Any help is appreciated.

Splunk_TA_Windows is installed on SF,HF,Indexers.

regards,

 

Labels (2)
0 Karma
1 Solution

tshah-splunk
Splunk Employee
Splunk Employee

Check the following btool command to identify the rendering of the windows events. 

$SPLUNK_HOME/bin/splunk btool inputs list <<input_name>> --debug | grep renderXML

If the value of the above parameter is set to true, then the events you receive will be in XML format, and hence the sourcetype. 

If you want the data to be not ingested in XML format, you can set the parameter to false and all new events will be in classic format with WinEventLog sourcetype

---
If you find the answer helpful, an upvote/karma is appreciated

View solution in original post

0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Check the following btool command to identify the rendering of the windows events. 

$SPLUNK_HOME/bin/splunk btool inputs list <<input_name>> --debug | grep renderXML

If the value of the above parameter is set to true, then the events you receive will be in XML format, and hence the sourcetype. 

If you want the data to be not ingested in XML format, you can set the parameter to false and all new events will be in classic format with WinEventLog sourcetype

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

SinghK
Builder

Its fixed. it was an issue with inputs on forwarders.

0 Karma

sb-e
New Member

Hello SinghK,

Could you please expand on your fix, i might be in the same senerio.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...