Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About VTARNG_Paul
VTARNG_Paul
Explorer
Member since:
05-03-2022
09-06-2022
Community Statistics
| Posts | 10 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 05-03-2022 |
Activity Feed
- Posted Re: DOD CAC/mod_rewrite on Security. 07-20-2022 12:42 PM
- Posted Re: How to creaate Splunk authentication with CAC / Smart Card and LDAP for Authorization? on Security. 07-20-2022 12:41 PM
- Posted Re: Using Splunk to Monitor Print Jobs on Getting Data In. 05-31-2022 12:01 PM
- Karma Re: XML Event Viewer Data Missing Message\Fields for VatsalJagani. 05-06-2022 04:51 AM
- Posted Re: XML Event Viewer Data Missing Message\Fields on Dashboards & Visualizations. 05-05-2022 11:37 AM
- Tagged Re: XML Event Viewer Data Missing Message\Fields on Dashboards & Visualizations. 05-05-2022 11:37 AM
- Posted Re: XML Event Viewer Data Missing Message\Fields on Dashboards & Visualizations. 05-05-2022 10:13 AM
- Posted Re: XML Event Viewer Data Missing Message\Fields on Dashboards & Visualizations. 05-05-2022 10:12 AM
- Tagged Re: XML Event Viewer Data Missing Message\Fields on Dashboards & Visualizations. 05-05-2022 10:12 AM
- Posted Re: Why does rex in dashboard says missing terminator - #2? on Dashboards & Visualizations. 05-05-2022 07:06 AM
- Karma Re: Why does rex in dashboard says missing terminator - #2? for richgalloway. 05-05-2022 07:06 AM
- Tagged XML Event Viewer Data Missing Message\Fields on Dashboards & Visualizations. 05-05-2022 04:55 AM
- Posted XML Event Viewer Data Missing Message\Fields on Dashboards & Visualizations. 05-05-2022 04:40 AM
- Posted Re: Why does rex in dashboard says missing terminator - #2? on Dashboards & Visualizations. 05-05-2022 04:31 AM
- Posted Why does rex in dashboard says missing terminator - #2? on Dashboards & Visualizations. 05-04-2022 11:38 AM
Topics I've Started
07-20-2022
12:42 PM
FYI- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SetupCACPIV
... View more
07-20-2022
12:41 PM
FYI - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SetupCACPIV
... View more
05-31-2022
12:01 PM
Hi, I have added the //Jobs stanza into the input.conf file on the print server, but unfortunately I am not seeing the user field. Please let me know if you have any recommendations. /Paul
... View more
05-05-2022
11:37 AM
Hi, You are correct the Message field is not included and other fields that I would like to use have generic names, Data, which is not very helpful for the reports/dashboard I want to make. We are using xml because it requires less storage space and possibly faster, but have not really seen any performance advantage from my testing so far. I think we might have to rethink the xml version of that data. VTARNG_Paul_0-1651775777525.png Cheers, Paul
... View more
- Tags:
- Simple XML
05-05-2022
10:13 AM
Hi, I am not seeing any non-binary setting for Event Viewer data. Thanks!
... View more
05-05-2022
10:12 AM
Hi, From sourcetype XmlWinEventLog we are missing the data in these Event Viewer fields located in the General tab in this screenshot. For example TaskCategory and Keywords. It should be included as we are pulling the identical data from another server with sourcetype WinEventLog and all of those fields are in the events. VTARNG_Paul_0-1651770503624.png
... View more
- Tags:
- Simple XML
05-05-2022
07:06 AM
Thank you sir, you have resolved my issue. /Paul
... View more
05-05-2022
04:40 AM
Hi All, I was hoping that modification of KV_Mode=xml in props.conf under the [xmlwineventlog] stanza on the standalone index\search head\deployment server would properly parse the Event View data from servers, but unfortunately I am not seeing all the message data that should be included. Here is sample of data, please see Event.EventData.Binary field: VTARNG_Paul_0-1651750719929.png
... View more
- Tags:
- Simple XML
Labels
- Labels:
-
simple XML
05-05-2022
04:31 AM
Good morning Rich, I appreciate your response, but I am not understanding your explanation " because the regex contains HTML-encoded < and > characters." as I do not see the < and > characters. Could you highlight or modify the rex script with the proper syntax required for it to work correctly? Cheers, Paul
... View more
05-04-2022
11:38 AM
I appreciate any any assistance with my Rex error.
When running this Rex command:
| rex "New Logon:\s+Security ID:\s+(?<account>.*)"
I receive the following error, "Rex in dashboard says missing terminator"
Thanks in advance!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-06-2022
11:51 AM
|
