zhjygit

> rendering xml for sysmon?Change it in inputs.conf on PC of installled sysmon?  My inputs.conf path is C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default Is there other place to change for xml something? My...

C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = True index = windows source = WinEventLog:Microsoft-Windows-Sysmon/Operational I add a inputs.conf as follows: C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf： [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = false...

Maybe,what you say above is extremely different with issue #106. As you say, I delete the inputs.conf in path of xxx\local; I delete the added spec on C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\input.conf ...

In the demo video:https://www.youtube.com/watch?v=6tS8nz7sZMQ  However,In my splunk, there is no threathunting_file_summary on the dashboard of "about the app".  Is that the reason of no data on threathunting overview?

> In the demo video:https://www.youtube.com/watch?v=6tS8nz7sZMQ No use to stall the sysmon add-on. I guess the mostly reason is about the index threathunting_file_summary, I can search log via "index=windows", however the...

 As above ,I changed the enableSched from 0 to 1, however, there is no data on dashboard of "about the app":  Although I reboot PC of restart splunk,...

no use to install sysmon add on app:  I use local splunk without forward,the the command is as follows: C:\Program Files\Splunk\bin>splunk cmd btool inputs list --debug C:\Program Files\Splunk\bin>splunk cmd...

I reinstall the splunk.  As above, there is no threathunting_file_summary. I add index for threathunting app with windows、threathunting and threathunting_file_summary. Restart the splunk, nothing changed, remains no threathunting_file_summary, no...

Still not work sir. 1.C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft_sysmon\default\inputs.conf ## ## SPDX-FileCopyrightText: 2021 Splunk, Inc. ## SPDX-License-Identifier: LicenseRef-Splunk-8-2021 ## ## [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = 1 source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational [WinEventLog://WEC-Sysmon] disabled =...

Is it related to the warning?