As you are running Universal Forwarder it does not process the transforms by default. You could try enabling force_local_processing option for a sourcetype but it's not very well docummented and generally not advisable since it increases load on the UF (which is supposed to be as lightweight as possible). ... View more

As I wrote before - "I assume you checked the name for this particular Event Log (the name of the stanza must match the "Full Name" property from the EventLog properties page)" 🙂 Especially the part in the parentheses is important. And yes, naming of the Event Logs can be a bit confusing sometimes. (You can of course get the Event Log name with a quick PowerShell as well without the need to click through the Event Viewer). ... View more

@gcusello  Hi Giuseppe, thanks for the guidance! As you can tell I am a newbie here 😉  Actually I did posted a new question here https://community.splunk.com/t5/Getting-Data-In/How-to-forward-only-Windows-events-XML-to-a-3rd-party-system/td-p/680458. I was struggling and saw your Q/A. I understand filtering at forwarder is not a good idea. In any case I've figured out how exactly to filter things out in Splunk Server so my 3rd party partner would get XmlWinEvtLog messages only. Thanks again! Billy ... View more