Getting Data In

Ingesting XML and Classic WinEventLogs issue (renderXml=false)

Matias
Engager

I've recently updated the Splunk_TA_windows from version 4.1.8 to version 8.12. As I went through the documentation I noticed there was a new setting under inputs.conf that mentioned to set "renderXml=0" in order to keep WinEventLogs in "classic" or "friendly" mode. 

After making that update to the TA's deployed to all UF's and to the Indexer Cluster I'm now getting the same event under both formats. 

e.g., If I have an EventCode=4624 for a specific host, I run a search and I can see the same event (different format) with sources:

XmlWinEventLog:Security AND WinEventLog:Security

I only want the WinEventLogs in classic mode, don't need the XML at the moment. 😖

If I set renderXml=true I ONLY get XmlWinEventlogs.

Some Details:

- I ran btool for inputs on a dev UF and I can see that renderXml=false

- I ran btool for inputs in one indexer and I can see that renderXml=false

Splunk_TA_windows version 8.1.2 

My inputs.conf file

 

[WinEventLog://Security]
disabled = 0
renderXml = false

 

 

 

Does anyone have any idea why I'm still seeing both formats? 

 

Labels (4)
0 Karma
1 Solution

Matias
Engager

Seems like WEF was set up forwarding Xml WinEventLogs simultaneously duplicating events in different format. After disabling WEF I was able to confirm logs were ingested in desired "classic" format.

Also found this helpful:

https://www.splunk.com/en_us/blog/tips-and-tricks/what-the-wef-choosing-windows-event-forwarding-or-...

 

View solution in original post

Matias
Engager

Seems like WEF was set up forwarding Xml WinEventLogs simultaneously duplicating events in different format. After disabling WEF I was able to confirm logs were ingested in desired "classic" format.

Also found this helpful:

https://www.splunk.com/en_us/blog/tips-and-tricks/what-the-wef-choosing-windows-event-forwarding-or-...

 

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...