monitor security windows events with syslog

Getting Data In

hi there,

i monitor windows security event log from the DC with RAW SYSLOG.

i can see in Splunk the raw data (without the default Syslog RFC's) also i can see that the data as xml view.

When i downloaded the Splunk add on for windows i configured the WinEventLog source type to my UDP data input (where only windows security event log from the DC is delivered)

i can see that the fields are extracted with the XML headers

example:

System.EventId
EventData.LogonType

I Can only Receive syslog

thanks in advance

Get Updates on the Splunk Community!

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Data Drivers: How We're Streaming Real-Time F1 Telemetry Directly into Splunk ...

Data Drivers: Every Lap Tells a Story The Spectacle Two F1 racing sims go head-to-head on the .conf26 show ...