Empty/broken Windows XML and Classic messages
Currently I'm ingesting Windows Classic and Windows Sysmon XML using Splunk UF, and apply corresponding packs to convert to JSON and some custom modifications. Until few days everything worked, but now we are receiving empty or broken messages.
I'm running Splunk UFs 9.0.4/Splunk Cloud 9.0.2209.4 and Cribl 4.2.2.
Config on UFs, as recommended in the docs. On Cribl Worker s2s is v4.
disabled = false
defaultGroup = cribl-worker-1
sendCookedData = true
I noticed that Cribl defaults to fallback event breaker. No error/warnings in Cribl logs.