How to replace characters in raw logs?

[chenfan]

Hi Splunkers,
I plan to use props.conf and transforms.conf on the Heavy Forwarder (HF) to modify Windows data. Specifically, I need to replace the "&" character with "& " only​ in Event ID 4627 logs, while leaving all other Windows events unchanged. All Windows logs—including the modified ones—must then be forwarded from the HF to a third-party system.

Configured as below, but no luck.

transforms.conf

[fix_ampersand_encoding]

REGEX = EventID>4627</EventID>

DEST_KEY = _raw

SEDCMD = s/4627/1688/g

The sample:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4627</EventID><Version>0</Version><Level>0</Level><Task>12554</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2026-07-28T04:42:51.8098076Z'/><EventRecordID>570893</EventRecordID><Correlation ActivityID='{b142e0e3-1d8b-0000-dfe8-42b18b1ddd01}'/><Execution ProcessID='1080' ThreadID='16360'/><Channel>Security</Channel><Computer>LAPTOP-00GC5NSH</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>LAPTOP-00GC5NSH$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='TargetUserSid'>S-1-5-21-4159868968-2951016168-3737308357-1001</Data><Data Name='TargetUserName'>华硕</Data><Data Name='TargetDomainName'>LAPTOP-00GC5NSH</Data><Data Name='TargetLogonId'>0x193b5a0d</Data><Data Name='LogonType'>2</Data><Data Name='EventIdx'>1</Data><Data Name='EventCountTotal'>1</Data><Data Name='GroupMembership'>

LAPTOP-00GC5NSH\None

Everyone

BUILTIN\Administrators

BUILTIN\Users

NT AUTHORITY\INTERACTIVE

CONSOLE LOGON

NT AUTHORITY\Authenticated&Users

NT AUTHORITY\This&Organization

LOCAL

NT AUTHORITY\NTLM Authentication

Mandatory Label\High Mandatory Level</Data></EventData></Event>

[livehybrid · Accepted solution]

Hi @chenfan 

To modify these raw logs on a Heavy Forwarder, you could look at using INGEST_EVAL in transforms.conf with something like this:

props.conf
[xmlwineventlog]
TRANSFORMS-fix_amp = fix_ampersand_encoding

transforms.conf
[fix_ampersand_encoding]
INGEST_EVAL = _raw=if(match(_raw, "<EventID>4627</EventID>"), replace(_raw, "&", "&amp;"), _raw)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.