XmlWinEventLog:ForwardedEvents sourcetype field extraction issue

[tech_g706]

Hi,

I’m currently receiving Windows logs in Splunk via the (UF → HF → Splunk Cloud). The logs are being assigned to two sourcetypes:

• XmlWinEventLog

• XmlWinEventLog:ForwardedEvents

For the XmlWinEventLog sourcetype, field extractions are working correctly. However, for the XmlWinEventLog:ForwardedEvents sourcetype, no field extractions are being applied, even though the log format appears to be the same.

Since I am not very familiar with the XmlWinEventLog:ForwardedEvents sourcetype, I would like guidance on how to configure the Heavy Forwarder so that it applies the same field extractions used by XmlWinEventLog to XmlWinEventLog:ForwardedEvents.

Thank you for your support.

[richgalloway]

To ensure proper processing of data, EVERY sourcetype should have settings in a props.conf file.  This keeps Splunk from having to guess about the data and improves onboarding performance.

If data with the XmlWinEventLog:ForwardedEvents sourcetype looks similar to data with the XmlWinEventLog sourcetype then it's a simple matter of copying the XmlWinEventLog stanza in props.conf to create a XmlWinEventLog:ForwardedEvents stanza.