Splunk Search

WinEventLog input xmlRegex modifier -- When did THIS become available?

dstaulcu
Builder

I've been on the struggle bus with WinEventLog blacklist entries this week and stumbled upon the new xmlRegex modifier.    Anyone know which version of the Splunk Universal forwarder introduced this capability?

Note:  The Splunk docs surrounding advanced white/blacklisting of WinEventLog inputs have improved significantly!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I don't know when it first became available, but xmlRegex has been around since 7.0.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't know when it first became available, but xmlRegex has been around since 7.0.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dstaulcu
Builder

good enough for me.  if operating any older of a version id have bigger problems to fixate on.  thanks!

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...