Splunk Search

WinEventLog input xmlRegex modifier -- When did THIS become available?

dstaulcu
Builder

I've been on the struggle bus with WinEventLog blacklist entries this week and stumbled upon the new xmlRegex modifier.    Anyone know which version of the Splunk Universal forwarder introduced this capability?

Note:  The Splunk docs surrounding advanced white/blacklisting of WinEventLog inputs have improved significantly!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I don't know when it first became available, but xmlRegex has been around since 7.0.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't know when it first became available, but xmlRegex has been around since 7.0.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dstaulcu
Builder

good enough for me.  if operating any older of a version id have bigger problems to fixate on.  thanks!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...