monitor security windows events with syslog

[LiorG]

hi there,

i monitor windows security event log from the DC with RAW SYSLOG.

i can see in Splunk the raw data (without the default Syslog RFC's) also i can see that the data as xml view.

When i downloaded the Splunk add on for windows i configured the WinEventLog source type to my UDP data input (where only windows  security event log from the DC is delivered)

i can see that the fields are extracted with the XML headers 

example:

System.EventId
EventData.LogonType

I Can only Receive syslog 

thanks in advance