Getting Data In

How to change from XML format to "Normal" format?

jamie1
Communicator

Hi there,

Before installing the Windows TA addon to a server , Windows Event Logs were shown in a different format, they are now shown in XML. I want to see searches in the original format.

I have checked the inputs.conf file and noticed "renderXml=true", I changed this to "renderXml=false" but it hasn't made a difference. 

Any help would be appreciated.

Jamie

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jamie1,

then try :

 

renderXml = false

then, a very stupid question (only to cancel every possible error!): obviously you restarted Splunk on the UF after update.

 

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jamie1,

add 

renderXml = False

to your inputs.conf stanzas.

For more infos, see at https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Inputsconf

renderXml = <boolean>
* Whether or not the input returns the event data in XML (eXtensible Markup
  Language) format or in plain text.
* Set this to "true" to render events in XML.
* Set this to "false" to output events in plain text.
* If you set this setting to "true", you should also set the 'suppress_text',
  'suppress_sourcename', 'suppress_keywords', 'suppress_task', and
  'suppress_opcode' settings to "true" to improve thruput performance.
* Default: false

Ciao.

Giuseppe

jamie1
Communicator

Hi Giuseppe,

I have added this line to the stanzas within the UF inputs.conf and the Windows TA inputs.conf and it doesn't seem to have worked.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jamie1,

then try :

 

renderXml = false

then, a very stupid question (only to cancel every possible error!): obviously you restarted Splunk on the UF after update.

 

Ciao.

Giuseppe

jamie1
Communicator

Hi @gcusello,

Switching to lowercase and spacing the words between the = fixed it.

Thanks for your help 🙂

Jamie

gcusello
SplunkTrust
SplunkTrust

Hi @jamie1,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...