https://community.splunk.com/t5/Getting-Data-In/How-does-a-LOOKUP-and-Report-command-work-in-a-PROPS-CONF/m-p/431111#M100246 <P>We have to use Graylog to forward Windows events to our SPLUNK. However we are trying to use CIM model and we have asked the graylog folks to alias some fields. I have been looking at the props.conf from the slunk_ta_windows app and asking our graylog folks to alias the fields to match those in the TA_windows app, which as long as I set the source and source type to wineventlog:security they appear to be working. But I am trying to understand these commands and what they do?</P> <P>LOOKUP-action_for_windows0_security = windows_audit_changes_lookup EventCode OUTPUTNEW action,change_type,object_category<BR /> REPORT-privilege_id_for_windows_security = privilege_id_for_windows_security</P> <P>Once I can understand these I can probably get closer to all the fields I need graylog to send.</P> <P>Thanks!</P> Tue, 29 Sep 2020 21:39:50 GMT pfabrizi 2020-09-29T21:39:50Z https://community.splunk.com/t5/Getting-Data-In/How-does-a-LOOKUP-and-Report-command-work-in-a-PROPS-CONF/m-p/431111#M100246 <P>We have to use Graylog to forward Windows events to our SPLUNK. However we are trying to use CIM model and we have asked the graylog folks to alias some fields. I have been looking at the props.conf from the slunk_ta_windows app and asking our graylog folks to alias the fields to match those in the TA_windows app, which as long as I set the source and source type to wineventlog:security they appear to be working. But I am trying to understand these commands and what they do?</P> <P>LOOKUP-action_for_windows0_security = windows_audit_changes_lookup EventCode OUTPUTNEW action,change_type,object_category<BR /> REPORT-privilege_id_for_windows_security = privilege_id_for_windows_security</P> <P>Once I can understand these I can probably get closer to all the fields I need graylog to send.</P> <P>Thanks!</P> Tue, 29 Sep 2020 21:39:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-a-LOOKUP-and-Report-command-work-in-a-PROPS-CONF/m-p/431111#M100246 pfabrizi 2020-09-29T21:39:50Z