We are currently forwarding Windows security event 4698 to Splunk, and would like to be able to parse/extract a number of the XML fields. Is there a way that Splunk can be configured to do this, or will we need to create custom field extractions for the XML fields that we are interested in?
Just messing around in my environment it looks like you can rex out the xml to another field and then use spath to find specific data in there. For example, this will put the xml for the task in a field called taskxml. Then pipe to spath and looking at that new field, grab the Action execution settings (putting it in a new field called actioncommand)
index=wineventlog EventCode=4698 | rex "(?i)(?<task_xml>\<task[\s\S]+\<\/task\>)" | spath input=task_xml output=action_command path=Task.Actions.Exec.Command