Issue with EventID field extraction in Windows_TA app

Today’s very short post is about an issue I came across viewing Application event logs that were onboarded using the Windows_TA app. The EventID field wasn’t being populated for most events. When I looked closer at the events, I could see that EventID can be represented in two different ways in different events:

<EventID>1530</EventID>

<EventID Qualifiers='16384'>16384</EventID>

The first one has EventID extracted successfully, but the second one does not.

The fix was simple. I added a global field extraction for sourcetype XmlWinEventLog:Application:

>(?P<EventID>\d+)<\/EventID>

I’ve submitted this feedback to the Splunk team, and I’ll update this post if it’s resolved in future updates of the Windows_TA app.

Rate this post:
Share this post:

Leave a Reply