Hello everyone,
I try to "ADD DATA" and specifically add the file "Microsoft-Windows-Windows Defender% 4Operational.evtx", but always Splunk fails to parse it and displays unreadable data.
My goal is to monitor my Windows Defender logs, so I tried to set the source type to "preprocess-winevt" as suggested in one article, but the result of this was quite strange, and the data, as you can see in the image, was neat but on the other hand, the data was not being parsed eventually.
Also, I do not understand why Splunk manages to parse ".evtx" files such as "application, security and more..." but on the other hand, can not parse the ".evtx" file from the same directory and machine?
-- What am I doing wrong?
I mention that I want to get the file data of: "C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender% 4Operational.evtx"
