Splunk Search

Field extrations from XmlWinEventLog

Path Finder

I've been trying to find a good solution to extract fields from some XML windows event logs.
For instance sourcetype="xmlwineventlog:microsoft-windows-base-filtering-engine-connections/operational"

A record from this might look like this:

<?xml version="1.0"?>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Provider Name="Microsoft-Windows-Base-Filtering-Engine-Connections" Guid="{guid removed}"/>
    <TimeCreated SystemTime="2017-05-11T08:31:38.735136100Z"/>
    <Execution ProcessID="1152" ThreadID="9924"/>
    <Security UserID="removed"/>
    <Data Name="ConnectionId">13138485797994339311</Data>
    <Data Name="MachineAuthenticationMethod">4</Data>
    <Data Name="RemoteMachineAccount">remote, machine, account, removed</Data>
    <Data Name="UserAuthenticationMethod">5</Data>
    <Data Name="RemoteUserAcount">domain\user</Data>
    <Data Name="RemoteIPAddress">IPv6addr removed</Data>
    <Data Name="LocalIPAddress">local IPv6addr removed</Data>
    <Data Name="TechnologyProviderKey">{1BEBC969-61A5-4732-A177-847A0817862A}</Data>
    <Data Name="IPsecTrafficMode">1</Data>
    <Data Name="BytesTransferredInbound">10128</Data>
    <Data Name="BytesTransferredOutbound">10528</Data>
    <Data Name="BytesTransferredTotal">20656</Data>
    <Data Name="StartTime">2017-05-11T08:30:03.155Z</Data>
    <Data Name="CloseTime">2017-05-11T08:31:38.724Z</Data>

In this case it is the <Data name="whatever">blah>/Data> fields that are most interesting to extract.
I've tried KV_MODE=xml, but that does not parse anything, neither does xmlkv, which perhaps isn't a surprise.

So any suggestions on the easiest way to parse this? I'd prefer not to have to manually define the fields, since there are several different sourcetypes I need to do this for.


Tags (2)
0 Karma


Did you find any solution to this? I'm using the TA for Windows, which collects XmlWinEventLog with renderXml=true and does a lot of report stuff in props.conf, but still there are no field extractions on the searh head.

0 Karma


You might try renderXml=true in your inputs.conf file beneath the stanza for that sourcetype, under the app you're working with.


0 Karma

Path Finder

I forgot to mention that .
I have renderXML=true in the inputs. So I get the XML data, just looking for the best way to extract all the fields automatically.

0 Karma


Hmm, the Splunk Add on for Windows contains field extractions for Windows-based XML logs in both the props and transforms. Are you using this app? https://splunkbase.splunk.com/app/742/

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...