Hi,   I am having some big issues trying to parse certain XML logs into Splunk. A sample online log which is in the same format as what I see in Splunk _raw logs are as below:   <Event><System><Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-****-*******}"/><EventID>3</EventID><Version>5</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime="2023-11-13T13:34:45.693615000Z"/><EventRecordID>140108</EventRecordID><Correlation/><Execution ProcessID="24493" ThreadID="24493"/><Channel>Linux-Sysmon/Operational</Channel><Computer>computername</Computer><Security UserId="0"/></System><EventData><Data Name="RuleName">-</Data><Data Name="UtcTime">2023-11-13 13:34:45.697</Data><Data Name="ProcessGuid">{ba131d2e-2a52-6550-285f-207366550000}</Data><Data Name="ProcessId">64284</Data><Data Name="Image">/opt/splunkforwarder/bin/splunkd</Data><Data Name="User">root</Data><Data Name="Protocol">tcp</Data><Data Name="Initiated">true</Data><Data Name="SourceIsIpv6">false</Data><Data Name="SourceIp">x.x.x.x</Data><Data Name="SourceHostname">-</Data><Data Name="SourcePort">60164</Data><Data Name="SourcePortName">-</Data><Data Name="DestinationIsIpv6">false</Data><Data Name="DestinationIp">x.x.x.x</Data><Data Name="DestinationHostname">-</Data><Data Name="DestinationPort">8089</Data><Data Name="DestinationPortName">-</Data></EventData></Event>   I have in the transforms.conf  [sysmon-eventid] REGEX = <EventID>(\d+)</EventID> FORMAT = EventID::$1 [sysmon-computer] REGEX = <Computer>(.*?)</Computer> FORMAT = Computer::$1 [sysmon-data] REGEX = <Data Name="(.*?)">(.*?)</Data> FORMAT = $1::$2   These are then called in the props.conf with some logic and: REPORT-sysmon = sysmon-eventID,sysmon-computer,sysmon-data   For some reason, the computer field is extracted successfully but not eventID or data name fields.  I have also tested the regex in regex.101 but not working. I am not sure if it's the raw logs having issues or something else?   Things I have tried: confirmed it is calling the correct sourcetype KV_MODE=xml in props.conf which doesn't parse it properly DATATYPE =xml in props.conf which doesn't work Tried changing the regex to something else but doesn't work tried changing the end of </EventID> to <\/EventID> which did nothing Not sure what else to try ?   Thanks   ... View more

Hi, I am currently learning Splunk and trying to set up for myself on my local machine. I am looking at the Splunk BOTS v2 guide and can see there are a number of apps to be added. There is one app which I am unsure how to download and add to the web gui as there are no links to download. App: Collectd App for Splunk Enterprise https://splunkbase.splunk.com/app/2875/ Upon visiting the site (to GitHub), I am presented with some instructions to configure things which is a little confusing for new starters, but also not able to see the app download link. Am I missing something here or it's just no longer relevant for V2? I am not using any forwarders, indexers etc, just one host to try set this up.   Thanks. ... View more