WinEventLog vs XmlWinEventLog

[thebankitgui]

Good Morning,

I am running into an issue where my two newest Server 2022 endpoints have events that are showing up non-XML, whereas all my other endpoints are outputting in XML. I have renderXml=true in the inputs.conf and the inputs.conf files in the Splunk_TA_windows are the same for each endpoint. I can't find the difference causing this.

One thing I have learned through this is that I may prefer non-XML so if these two endpoints are not respecting renderXml=true, how do I know all the others will respect the false value to match them all up? Is there somewhere overriding this? I have not edited any \etc\system\default\inputs.conf files. They're all in local or an app.

Thank you in advance!

Edit: I am on Splunk Cloud.

Scott

[mmccul]

First thing to check is of course btool

splunk btool inputs list --debug

for the respective inputs.  If it shows renderXml set to false, for those inputs, then some other setting is overriding the setting you are trying to apply.  Adding the --debug flag lets you know which file provides the winning setting, so you can figure out where it is coming from.