Can you help me get fields in different languages to be displayed only in English?

[jip31]

Hi,

I have to query the event viewer, but some fields that are in bold are in different languages. What do I have to do in order to collect and to display them (| table _time host Type EventCode OpCode "File_Name" "Degradation_Time) in only one language (english)?

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Détérioration du démarrage" TaskCategory="Analyse des performances de démarrage" Nom_du_fichier=* "Durée de la dégradation"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Boot Degradation" TaskCategory="Boot Performance Monitoring" File_Name=* Degradation_Time=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Información del arranque" TaskCategory="Supervisión de rendimiento del arranque" "Duración del arranque"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Startbeeinträchtigung" TaskCategory="Systemstart-Leistungsüberwachung" Dateiname=Devi "Beeinträchtigungszeit"=*

Thanks for your help.

[chrisyounger]

You should configure your inputs.conf to set renderXml = 1 this will force the logs to be collected in English only.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWindowseventlogdata#Display_events_in...

There is a note on that page: When you instruct Splunk Enterprise to render events in XML, event keys within the XML event render in English regardless of the machine system locale.

Good luck!

[jip31]

it's strange because renderXml is configurated like this....