Getting Data In

Windows log in XML format - how to convert numbers to text description

lukasmecir
Path Finder

Hello,

I would like to ask about win log in XML format:

Using Splunk, we collect Windows logs in XML format, because before indexing on Splunk, we modify and reduce them on Cribl - according to this document: Reducing Windows XML Events 

It works fine, but now I would like to do one thing - convert values that are expressed in XML using numeric code to expressions in text form, as in the standard Windows log format. For example:

In XML is:

<Task>12544</Task>

and corresponding value in text format of log is:

TaskCategory=Logon

So I tried to find conversion tables between text and XML format and  for elements

<Opcode>
<Keywords>
<Level>

I found some. But I cannot find any for element

<Task>

Do you know anyone about some? (Or for other XML elements as well)? If so, you can share it with me? It will be really appreciated.

Best regards

Lukas Mecir

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...