Has anyone been able to figure out how to search indexed XmlWinEventLog sourcetype sample logs in the Ingest Action GUI?

[tjones130]

Has anyone been able to figure out how to search indexed XmlWinEventLog sourcetype sample logs in the Ingest Action GUI? The actual search being used uses the |where command which seems to be the issue.

index=* OR index=_* sourcetype="XmlWinEventLog"
| where sourcetype="XmlWinEventLog"
| head 100

  

[fjiang]

Hi there!

This was published as a known issue first in 9.0.2: https://docs.splunk.com/Documentation/Splunk/9.0.2/ReleaseNotes/KnownIssues

See the entry for SPL-235416.

The preview UI in Ingest Actions has since been fixed in:
Splunk Enterprise version 9.0.5+
Splunk Cloud Platform version 9.0.2303+

[ITWhisperer]

where is case-sensitive, search is not. Check the exact spelling and case of the sourcetype you are searching for.

[tjones130]

I have tried multiple variations of case-sensitivity, with no luck. The sourcetype that returns when running index=* sourcetype="XmlWinEventLog" is "XmlWinEventLog".