Hi,
I have to query the event viewer, but some fields that are in bold are in different languages. What do I have to do in order to collect and to display them (| table _time host Type EventCode OpCode "File_Name" "Degradation_Time) in only one language (english)?
index="X" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Détérioration du démarrage" TaskCategory="Analyse des performances de démarrage" Nom_du_fichier=* "Durée de la dégradation"=*
index="X" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Boot Degradation" TaskCategory="Boot Performance Monitoring" File_Name=* Degradation_Time=*
index="X" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Información del arranque" TaskCategory="Supervisión de rendimiento del arranque" "Duración del arranque"=*
index="X" sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Startbeeinträchtigung" TaskCategory="Systemstart-Leistungsüberwachung" Dateiname=Devi "Beeinträchtigungszeit"=*
Thanks for your help.
You should configure your inputs.conf to set renderXml = 1
this will force the logs to be collected in English only.
There is a note on that page: When you instruct Splunk Enterprise to render events in XML, event keys within the XML event render in English regardless of the machine system locale.
Good luck!
it's strange because renderXml is configurated like this....