Splunk Search

Field extrations from XmlWinEventLog

Path Finder

I've been trying to find a good solution to extract fields from some XML windows event logs.
For instance sourcetype="xmlwineventlog:microsoft-windows-base-filtering-engine-connections/operational"

A record from this might look like this:

<?xml version="1.0"?>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Provider Name="Microsoft-Windows-Base-Filtering-Engine-Connections" Guid="{guid removed}"/>
    <TimeCreated SystemTime="2017-05-11T08:31:38.735136100Z"/>
    <Execution ProcessID="1152" ThreadID="9924"/>
    <Security UserID="removed"/>
    <Data Name="ConnectionId">13138485797994339311</Data>
    <Data Name="MachineAuthenticationMethod">4</Data>
    <Data Name="RemoteMachineAccount">remote, machine, account, removed</Data>
    <Data Name="UserAuthenticationMethod">5</Data>
    <Data Name="RemoteUserAcount">domain\user</Data>
    <Data Name="RemoteIPAddress">IPv6addr removed</Data>
    <Data Name="LocalIPAddress">local IPv6addr removed</Data>
    <Data Name="TechnologyProviderKey">{1BEBC969-61A5-4732-A177-847A0817862A}</Data>
    <Data Name="IPsecTrafficMode">1</Data>
    <Data Name="BytesTransferredInbound">10128</Data>
    <Data Name="BytesTransferredOutbound">10528</Data>
    <Data Name="BytesTransferredTotal">20656</Data>
    <Data Name="StartTime">2017-05-11T08:30:03.155Z</Data>
    <Data Name="CloseTime">2017-05-11T08:31:38.724Z</Data>

In this case it is the <Data name="whatever">blah>/Data> fields that are most interesting to extract.
I've tried KV_MODE=xml, but that does not parse anything, neither does xmlkv, which perhaps isn't a surprise.

So any suggestions on the easiest way to parse this? I'd prefer not to have to manually define the fields, since there are several different sourcetypes I need to do this for.


Tags (2)
0 Karma


Did you find any solution to this? I'm using the TA for Windows, which collects XmlWinEventLog with renderXml=true and does a lot of report stuff in props.conf, but still there are no field extractions on the searh head.

0 Karma


You might try renderXml=true in your inputs.conf file beneath the stanza for that sourcetype, under the app you're working with.


0 Karma

Path Finder

I forgot to mention that .
I have renderXML=true in the inputs. So I get the XML data, just looking for the best way to extract all the fields automatically.

0 Karma


Hmm, the Splunk Add on for Windows contains field extractions for Windows-based XML logs in both the props and transforms. Are you using this app? https://splunkbase.splunk.com/app/742/

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...