Getting Data In

Splunk Add-On for Windows

pc1
Path Finder

I have the Splunk Add-On for Windows installed on my deployment server in order to help collect data from my windows machines (forwarders). However, when the data comes in - it is all condensed down into a block and more or less unreadable. The entries from it have the tags like <Event>, <System>, etc but it isn't spaced out at all and bunched together. Was curious if anyone knows how to make the data from this add-on look like how all other data usually comes into splunk - spaced out and indented and more readable to the human eye essentially. Not sure if this would be a splunk configuration or a configuration that has to be done specifically to my Windows Add-On settings on my deployment server. Thanks!

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Windows logs are being ingested as XML in default configuration. You can update

renderXml=0

in your inputs to get the events as text which is easier to read. 

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Windows logs are being ingested as XML in default configuration. You can update

renderXml=0

in your inputs to get the events as text which is easier to read. 

If this reply helps you an upvote is appreciated.

View solution in original post

pc1
Path Finder

I set renderXml=false instead of 0 which is more or less the same thing but just for anyone else who might come across this thread

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!