![alt text][1]When looking at windows event logs I notice that there are a lot of events that still have the and not this hinders my ability to table out different event ids.
I have tried to create a field extractor with the regx ">(?P\d+)<\/EventID>" as noted here https://visibleninja.guru/problemwith-eventid-field-extraction-in-windows_ta-app/.
This did not seem to parse out the event ids correctly. Where else should I put the regx key?
[1]: /storage/temp/275879-splunkfieldextract.jpg
↧