Windows TA field extractions are not working

[iainsmart]

Hi,

When I search for Windows Event Logs using :
index=oswin sourcetype=XmlWinEventLog

I'm not getting any parsing/syntax highlighting or field extractions happening. The results are simply the raw XML. I have checked that I am in List format!

If I search for other indexes and sourcetypes I am getting correct parsing/syntax highlighting and extractions.

How can I go about finding out why this is happening and fix it?

Thanks,

Iain

[irievibe]

I have the same problem and have TA everywhere and using verbose mode

The windows event viewer shows

...."Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
SYNCHRONIZE
ReadAttributes

Access Reasons: DELETE: Granted by D:(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)"

But in Splunk all I see is:

<Data Name='AccessList'>%%1537 %%1541 %%4423 </Data><Data Name='AccessReason'>%%1537: %%1801 😧(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)

I have many fields being parsed, but I don't even see "Accesss" in the raw data. It seems this is not being parsed correctly but also, Splunk isn't even able to read the data from Windows correctly to include Accesses: DELETE in the raw data

[irievibe]

I found that the Windows_TA app had the Security stanza disabled on my indexer. I had it set for forwarder and search head, but the indexer was misconfigured.
EventCode=4656 Accessed=DELETE works for me now

[richgalloway]

Make sure you are in Verbose mode and that the Windows TA is installed on your search head.

[iainsmart]

I am in Verbose mode and the TA is installed on the search head