hi there, i monitor windows security event log from the DC with RAW SYSLOG. i can see in Splunk the raw data (without the default Syslog RFC's) also i can see that the data as xml view. When i downloaded the Splunk add on for windows i configured the WinEventLog source type to my UDP data input (where only windows  security event log from the DC is delivered) i can see that the fields are extracted with the XML headers  example: System.EventId EventData.LogonType   I Can only Receive syslog  thanks in advance ... View more

hi there, i created a dashbord with drilldown values with backslash. how can i escape those backslash to ged values in my search ... View more