Getting Data In

Splunk Add-On for Windows

pc1
Path Finder

I have the Splunk Add-On for Windows installed on my deployment server in order to help collect data from my windows machines (forwarders). However, when the data comes in - it is all condensed down into a block and more or less unreadable. The entries from it have the tags like <Event>, <System>, etc but it isn't spaced out at all and bunched together. Was curious if anyone knows how to make the data from this add-on look like how all other data usually comes into splunk - spaced out and indented and more readable to the human eye essentially. Not sure if this would be a splunk configuration or a configuration that has to be done specifically to my Windows Add-On settings on my deployment server. Thanks!

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Windows logs are being ingested as XML in default configuration. You can update

renderXml=0

in your inputs to get the events as text which is easier to read. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Windows logs are being ingested as XML in default configuration. You can update

renderXml=0

in your inputs to get the events as text which is easier to read. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

pc1
Path Finder

I set renderXml=false instead of 0 which is more or less the same thing but just for anyone else who might come across this thread

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...