Splunk Search
Highlighted

Windows TA field extractions are not working

Engager

Hi,

When I search for Windows Event Logs using :
index=oswin sourcetype=XmlWinEventLog

I'm not getting any parsing/syntax highlighting or field extractions happening. The results are simply the raw XML. I have checked that I am in List format!

If I search for other indexes and sourcetypes I am getting correct parsing/syntax highlighting and extractions.

How can I go about finding out why this is happening and fix it?

Thanks,

Iain

0 Karma
Highlighted

Re: Windows TA field extractions are not working

SplunkTrust
SplunkTrust

Make sure you are in Verbose mode and that the Windows TA is installed on your search head.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Windows TA field extractions are not working

Engager

I am in Verbose mode and the TA is installed on the search head

0 Karma