How to change from XML format to "Normal" format?

[jamie1]

Hi there,

Before installing the Windows TA addon to a server , Windows Event Logs were shown in a different format, they are now shown in XML. I want to see searches in the original format.

I have checked the inputs.conf file and noticed "renderXml=true", I changed this to "renderXml=false" but it hasn't made a difference. 

Any help would be appreciated.

Jamie

[gcusello]

Hi @jamie1,

add 

renderXml = False

to your inputs.conf stanzas.

For more infos, see at https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Inputsconf

renderXml = <boolean>
* Whether or not the input returns the event data in XML (eXtensible Markup
  Language) format or in plain text.
* Set this to "true" to render events in XML.
* Set this to "false" to output events in plain text.
* If you set this setting to "true", you should also set the 'suppress_text',
  'suppress_sourcename', 'suppress_keywords', 'suppress_task', and
  'suppress_opcode' settings to "true" to improve thruput performance.
* Default: false

Ciao.

Giuseppe

[jamie1]

Hi Giuseppe,

I have added this line to the stanzas within the UF inputs.conf and the Windows TA inputs.conf and it doesn't seem to have worked.

[gcusello · Accepted solution]

Hi @jamie1,

then try :

renderXml = false

then, a very stupid question (only to cancel every possible error!): obviously you restarted Splunk on the UF after update.

Ciao.

Giuseppe

[jamie1]

Hi @gcusello,

Switching to lowercase and spacing the words between the = fixed it.

Thanks for your help 🙂

Jamie

[gcusello]

Hi @jamie1,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉