Has anyone been able to figure out how to search indexed XmlWinEventLog sourcetype sample logs in the Ingest Action GUI?

[tjones130]

Has anyone been able to figure out how to search indexed XmlWinEventLog sourcetype sample logs in the Ingest Action GUI? The actual search being used uses the |where command which seems to be the issue.

index=* OR index=_* sourcetype="XmlWinEventLog"
| where sourcetype="XmlWinEventLog"
| head 100

  

[ITWhisperer]

where is case-sensitive, search is not. Check the exact spelling and case of the sourcetype you are searching for.

[tjones130]

I have tried multiple variations of case-sensitivity, with no luck. The sourcetype that returns when running index=* sourcetype="XmlWinEventLog" is "XmlWinEventLog".