Monitoring Splunk

Can you help me get fields in different languages to be displayed only in English?

jip31
Motivator

Hi,

I have to query the event viewer, but some fields that are in bold are in different languages. What do I have to do in order to collect and to display them (| table _time host Type EventCode OpCode "File_Name" "Degradation_Time) in only one language (english)?

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Détérioration du démarrage" TaskCategory="Analyse des performances de démarrage" Nom_du_fichier=* "Durée de la dégradation"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Boot Degradation" TaskCategory="Boot Performance Monitoring" File_Name=* Degradation_Time=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Información del arranque" TaskCategory="Supervisión de rendimiento del arranque" "Duración del arranque"=*

index="X"  sourcetype="WinEventLog:Microsoft-Windows-Diagnostics-Performance/Operational" (EventCode>="100" AND EventCode <="199") Type=* OpCode="Startbeeinträchtigung" TaskCategory="Systemstart-Leistungsüberwachung" Dateiname=Devi "Beeinträchtigungszeit"=*

Thanks for your help.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You should configure your inputs.conf to set renderXml = 1 this will force the logs to be collected in English only.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWindowseventlogdata#Display_events_in...

There is a note on that page: When you instruct Splunk Enterprise to render events in XML, event keys within the XML event render in English regardless of the machine system locale.

Good luck!

jip31
Motivator

it's strange because renderXml is configurated like this....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...