try below [ testxmlst ] CHARSET=UTF-8 DATETIME_CONFIG=CURRENT KV_MODE=xml NO_BINARY_CHECK=true SHOULD_LINEMERGE=false disabled=false pulldown_type=true ... View more

I found what was wrong. In input.conf we set "renderXml = true" . That's why props.conf doesn't apply to source::WinEventLog://ForwardedEvents. Cause source::WinEventLog://ForwardedEvents doesn't exist ! When i change it to "renderXml = false", filter start working! But, i still need get this events in XML. Is there any way to do that? "How are you getting the data into heavy forwarder, from universal forwarder?" No, we collect all events by Windows Event collecor server in ForwardedEvents log. On the same VM we deploy heavy forwarder + Windows_TA addon with all necessary conf. ... View more

since this app looks to be abandoned - see this one... seems pretty good. https://splunkbase.splunk.com/app/2895/#/details ... View more