- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there,
Before installing the Windows TA addon to a server , Windows Event Logs were shown in a different format, they are now shown in XML. I want to see searches in the original format.
I have checked the inputs.conf file and noticed "renderXml=true", I changed this to "renderXml=false" but it hasn't made a difference.
Any help would be appreciated.
Jamie
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @jamie1,
then try :
renderXml = false
then, a very stupid question (only to cancel every possible error!): obviously you restarted Splunk on the UF after update.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @jamie1,
add
renderXml = False
to your inputs.conf stanzas.
For more infos, see at https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Inputsconf
renderXml = <boolean>
* Whether or not the input returns the event data in XML (eXtensible Markup
Language) format or in plain text.
* Set this to "true" to render events in XML.
* Set this to "false" to output events in plain text.
* If you set this setting to "true", you should also set the 'suppress_text',
'suppress_sourcename', 'suppress_keywords', 'suppress_task', and
'suppress_opcode' settings to "true" to improve thruput performance.
* Default: false
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Giuseppe,
I have added this line to the stanzas within the UF inputs.conf and the Windows TA inputs.conf and it doesn't seem to have worked.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @jamie1,
then try :
renderXml = false
then, a very stupid question (only to cancel every possible error!): obviously you restarted Splunk on the UF after update.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @gcusello,
Switching to lowercase and spacing the words between the = fixed it.
Thanks for your help 🙂
Jamie
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @jamie1,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
