By default it considering the whitespace while parsing the fieldname in wineventlog

[RanjiRaje]

Hi, can anyone help me with the solution please.

I have wineventlog as below. By default it considering the whitespace while parsing the fieldname.

For eg: it should extract the field name as "Provider Name", but instead it is extracting the field name as "Name". It considering whitespace and extracting the filename.

Similarly I have many fields as highlighted below. please guide me where I have to make such change to get the correct field names.

Sample Log:

<Event xmlns='http://XXX.YYYY.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{12345-1111-2222-a5ba-XXX}'/><EventID>2222</EventID><Version>0</Version><Level>0</Level><Task>12345</Task><Opcode>0</Opcode><Keywords>1110000000000000</Keywords><TimeCreated SystemTime='2024-07-24T11:36:15.892441300Z'/><EventRecordID>0123456789</EventRecordID><Correlation ActivityID='{11aa2222-abc2-0001-0002-XXXX1122}'/><Execution ProcessID='111' ThreadID='111'/><Channel>Security</Channel><Computer>YYY.xxx.com</Computer><Security/></System><EventData><Data Name='MemberName'>-</Data><Data Name='MemberSid'>CORP\gpininfra-svcaccounts</Data><Data Name='TargetUserName'>Administrators</Data><Data Name='TargetDomainName'>Builtin</Data><Data Name='TargetSid'>BUILTIN\Administrators</Data><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>xyz$</Data><Data Name='SubjectDomainName'>CORP</Data><Data Name='SubjectLogonId'>1A2B</Data><Data Name='PrivilegeList'>-</Data></EventData></Event>

[ITWhisperer · Accepted solution]

The element (field) is "Provider", "Name" and "Guid" for that matter are attribute of the element.

For example, if you extract the fields with spath you will get ...Provider@Name showing that it is an attribute. 

[RanjiRaje]

Hi, Thanks for your reply. I just had a look in transforms.conff file and seen such stanzas

[system_props_xml_attributes]
# Extracts values from following fields:
# Provider: Name, Guid
# TimeCreated: SystemTime, RawTime
# Correlation: ActivityID, RelativeActivityID
# Execution: ProcessID, ThreadID, ProcessorID, SessionID, KernelTime, UserTime, ProcessorTime
# Security: UserID

So, for the element "Provider" - Name & Guid are attributes
similarly for the element "Timecreated" - systemtime & rawtime are attributes

So the fields are parsing correctly right ?

[ITWhisperer]

It looks that way

[RanjiRaje]

thanks for clarifying