Need Solution as earliest as possible, Help will be much appreciated as i am struggling since days of this issue, cannot go to the next step of my project. Here’s the latest update on my Sysmon parsing issue: I’ve now confirmed the following: Sysmon TA v5.0.0 (Splunk_TA_microsoft_sysmon) is installed on my Splunk VM (which acts as both Indexer + Search Head). UF on Windows forwards Sysmon logs using: [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = 1 sourcetype = XmlWinEventLog source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational index = sysmon_logs Data ingestion works — events arrive fine under sourcetype=XmlWinEventLog and source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational. TA overrides removed (TA-sysmon-overrides.disabled) — verified no local props/transforms overriding the Sysmon TA. CIM installed — | tstats count from datamodel=Endpoint.Processes shows results. btool verification shows correct sourcetype chain; no misconfig or duplicates. However, Sysmon events are still shown as raw XML, and none of the field extractions (like Image, ParentImage, CommandLine) appear — even though ingestion and sourcetype are correct. So far, I’ve verified: ✅ ingestion and indexing ✅ sourcetype normalization ✅ TA version and configuration ✅ CIM presence and tstats validation ✅ no conflicting props/transforms Yet parsing doesn’t occur at search-time. Could this be an issue with the Sysmon TA’s extraction logic not triggering for XmlWinEventLog events (even though the sourcetype matches)? Any next steps or validation checks you recommend to debug why XML extraction isn’t being applied? Attached screenshots are merged in 1 png: Raw Sysmon XML event from index=sysmon_logs Search showing sourcetype/source fields btool props list XmlWinEventLog --debug output
... View more
