Getting Data In

What is the best practice for data structure of Wineventlog?

anandhalagarasa
Path Finder

We are ingesting wineventlog into Splunk Cloud from all our client servers.
And the majority of the ingested data seems to be in XML format and few hosts are reporting with normal log structure.

So I want to know whether we can ingest the data in XML format itself or can I modify it to the normal structure by adding some stanza in the input .conf file of the wineventlog app.

Which one would be considered as a best practice and a recommended one as well?

0 Karma

jacobpevans
Motivator

Greetings @anandhalagarasan,

The inputs.conf command you are looking for is:

renderXML = false or
renderXML = true under a stanza similar to this:

[WinEventLog://Application] or
[WinEventLog://Security], etc.

See more information here: https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/Configuration

I can't comment on best practice. It's up to you and your environment as to which one works better for you - the important thing is to be consistent (ideally using a deployment server). We do not render XML since most of our users are more familiar with the standard way Windows displays Windows Events.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi anandhalagarasan,
how do you configured your input, do you used TA_Windows?
if not, use TA_Windows, if yes, please share inputs.conf.
Bye.
Giuseppe

0 Karma

anandhalagarasa
Path Finder

Kindly help on this request.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...