Monitoring Splunk

Can you help me get fields in different languages to be displayed only in English?

jip31
Motivator

Hi,

I have to query the event viewer, but some fields that are in bold are in different languages. What do I have to do in order to collect and to display them (| table _time host Type EventCode OpCode "File_Name" "Degradation_Time) in only one language (english)?

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Détérioration du démarrage" TaskCategory="Analyse des performances de démarrage" Nom_du_fichier=* "Durée de la dégradation"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Boot Degradation" TaskCategory="Boot Performance Monitoring" File_Name=* Degradation_Time=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Información del arranque" TaskCategory="Supervisión de rendimiento del arranque" "Duración del arranque"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Startbeeinträchtigung" TaskCategory="Systemstart-Leistungsüberwachung" Dateiname=Devi "Beeinträchtigungszeit"=*

Thanks for your help.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You should configure your inputs.conf to set renderXml = 1 this will force the logs to be collected in English only.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWindowseventlogdata#Display_events_in...

There is a note on that page: When you instruct Splunk Enterprise to render events in XML, event keys within the XML event render in English regardless of the machine system locale.

Good luck!

jip31
Motivator

it's strange because renderXml is configurated like this....

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>