Getting Data In

WinEventLogs Cannot get Event Details

nabeel652
Builder

I am monitoring WinEventLogs for Direct Access Troubleshooting using stanzas like:

[WinEventLog://Microsoft-Windows-Base-Filtering-Engine-Connections/Operational]
disabled = 0
index = myindex

I am successfully getting all events but the information I can see in Windows Event Viewer's Details tab is not received. The information in the logs in Splunk is pretty basic and almost useless.

I've uploaded two screenshots. DA_Logs shows what I am getting using the above stanza whereas DA_Logs2 is the what I actually need under "Details" tab from the Event Viewer.

alt text

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

The fields and values under the "Details" section of the Windows Event is actually what Windows would send if you set renderXml = 1 on. What you get when you either have renderXml = 0 (or if the setting just isn't in there) is the information under the "General" tab.

Normally these two sets of information are the same or at least very similar, but not always. It will always show different in field names and such, but that's to be expected since half of the non-xml events don't have field names properly anyway. In some cases the actual information is completely different.

My guess is this is what you are seeing. To fix, edit your input stanza and add to it:

[WinEventLog://Microsoft-Windows-Base-Filtering-Engine-Connections/Operational]
renderXml = 1
disabled = 0
index = myindex

After that (well, and appropriate UF restarts and whatnot) your events will come in looking as ugly as sin, BUT the fields will be far better and more usefully named and will have better content most of the time.

So, I'd recommend after the above change that you shorten your time frame, run it in verbose mode and exploring the new fields (rather than looking at and going blind from the raw XML).

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

The fields and values under the "Details" section of the Windows Event is actually what Windows would send if you set renderXml = 1 on. What you get when you either have renderXml = 0 (or if the setting just isn't in there) is the information under the "General" tab.

Normally these two sets of information are the same or at least very similar, but not always. It will always show different in field names and such, but that's to be expected since half of the non-xml events don't have field names properly anyway. In some cases the actual information is completely different.

My guess is this is what you are seeing. To fix, edit your input stanza and add to it:

[WinEventLog://Microsoft-Windows-Base-Filtering-Engine-Connections/Operational]
renderXml = 1
disabled = 0
index = myindex

After that (well, and appropriate UF restarts and whatnot) your events will come in looking as ugly as sin, BUT the fields will be far better and more usefully named and will have better content most of the time.

So, I'd recommend after the above change that you shorten your time frame, run it in verbose mode and exploring the new fields (rather than looking at and going blind from the raw XML).

0 Karma

ddrillic
Ultra Champion

Maybe the following can help - Monitor Windows event log data

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...