Getting Data In

Splunk Add-On for Windows

pc1
Path Finder

I have the Splunk Add-On for Windows installed on my deployment server in order to help collect data from my windows machines (forwarders). However, when the data comes in - it is all condensed down into a block and more or less unreadable. The entries from it have the tags like <Event>, <System>, etc but it isn't spaced out at all and bunched together. Was curious if anyone knows how to make the data from this add-on look like how all other data usually comes into splunk - spaced out and indented and more readable to the human eye essentially. Not sure if this would be a splunk configuration or a configuration that has to be done specifically to my Windows Add-On settings on my deployment server. Thanks!

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Windows logs are being ingested as XML in default configuration. You can update

renderXml=0

in your inputs to get the events as text which is easier to read. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Windows logs are being ingested as XML in default configuration. You can update

renderXml=0

in your inputs to get the events as text which is easier to read. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

pc1
Path Finder

I set renderXml=false instead of 0 which is more or less the same thing but just for anyone else who might come across this thread

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...