- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Can Splunk ingest the "Details tab - xml view" of ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
We have a customer that we are ingesting a number of windows event logs for ... we are using the pre-defined splunk source-type to ingest these.
We know that splunk captures the "Genera tabl" view details of the event, but our customer is asking if we can ingest the "Details tab" and under that there is a XML view. He is wanting to be able to search on a ID that shows up in the xml that unfortunately does not show in the "General tab" view.
Is splunk able to ingest that xml somehow?
Thanks for the help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm able to ingest the XML version of these events just fine. I seem to be having issues with line breaking. I can't seem to nail down the stanza line that will accurately display the data in a readable format. Anyone have a suggestion for the props.conf to achieve this? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hmmm. Are you in fact using the sourcetype already provided in the TAs referenced here? If so and still having problems it might be stronger to start a new question (feel free to cross reference this one) and provide greater detail.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check out renderXml here:
https://www.splunk.com/blog/2014/11/04/splunk-6-2-feature-overview-xml-event-logs.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would I need to download this Splunk_TA_Windows app? Can't tell if i do or it's just as simple as adding that line in my inputs.conf.
Thanks again.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can just add that line and it will change formats. It does not work for Windows (server?) 2003 and has some other caveats so I would read ALL the documentation pages on it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock,
Thanks for the help, it worked. Another question ... is this xml data getting indexed as well? Meaning are we getting "double charged" ?
Thanks again
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock - you missed a great opportunity to do the Socratic Method on @a548506 😉
@a548506 - How might you check for the answer to your question about licensing? Can you think of any particular dashboards, searches, datasources, etc.. that would facilitate this? Hint
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The XML is your new data exactly as you see it. The original event format is fully replaced so you are not getting "double".
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
