Hi all, I’m using the Splunk Universal Forwarder on Windows to collect event logs. My inputs.conf includes the following configurations: [WinEventLog://Security] disabled = 0 index = win_log [WinEventLog://System] disabled = 0 index = win_log [WinEventLog://Application] disabled = 0 index = win_log [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = 0 renderXml = true index = win_log   The first three (Security, System, and Application) work perfectly and show readable, structured logs. However, when I run: index=win_log sourcetype=*sysmon* I get logs in unreadable binary or hex format like: \x00\x00**\x00\x00 \x00\x00@\x00\x00\x00\x00\x00\x00\xCE....  How can I fix this and get properly parsed Sysmon logs (with fields like CommandLine, ParentProcess, etc.)? ... View more