What is the best practice for data structure of Wineventlog?

[anandhalagarasa]

We are ingesting wineventlog into Splunk Cloud from all our client servers.
And the majority of the ingested data seems to be in XML format and few hosts are reporting with normal log structure.

So I want to know whether we can ingest the data in XML format itself or can I modify it to the normal structure by adding some stanza in the input .conf file of the wineventlog app.

Which one would be considered as a best practice and a recommended one as well?

[jacobpevans]

Greetings @anandhalagarasan,

The inputs.conf command you are looking for is:

renderXML = false or
renderXML = true under a stanza similar to this:

[WinEventLog://Application] or
[WinEventLog://Security], etc.

See more information here: https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/Configuration

I can't comment on best practice. It's up to you and your environment as to which one works better for you - the important thing is to be consistent (ideally using a deployment server). We do not render XML since most of our users are more familiar with the standard way Windows displays Windows Events.

[gcusello]

Hi anandhalagarasan,
how do you configured your input, do you used TA_Windows?
if not, use TA_Windows, if yes, please share inputs.conf.
Bye.
Giuseppe

[anandhalagarasa]

Kindly help on this request.