topic Re: Windows log going to the wrong sourcetype in Getting Data In

Why is windows log going to the wrong sourcetype?

So76 — Mon, 25 Apr 2022 15:07:33 GMT

Logs are going to source= WinEventLog:Application and sourcetype="WinEventLog" instead of source="WinEventLog:Security" sourcetype="WinEventLog:Security"

Ran this search

index=*** sourcetype="*wineventlog*" rha***s-wds EventCode=517 signature="The audit log was cleared"

Re: Windows log going to the wrong sourcetype

VatsalJagani — Mon, 25 Apr 2022 05:37:29 GMT

@So76 - Can you please share the following information?

Splunk version
inputs.conf contains that is collecting the logs
Do you have any parsing stage dynamic metadata changing attributes?
- Search for "MetaData:Sourcetype" in transforms.conf on your indexers and heavy forwarders.

Re: Windows log going to the wrong sourcetype

isoutamo — Mon, 25 Apr 2022 09:17:35 GMT

Also you should told if you are using Splunk_TA_windows (also version) or have you just created those configurations by yourself?

If you are using it have you installed it on all needed layers (UF - HF/IDX - SH) or only in some?

r. Ismo

Re: Windows log going to the wrong sourcetype

So76 — Mon, 25 Apr 2022 12:57:58 GMT

Below is the config in TA_windows. No props or transforms. I did not configure it

[WinEventLog://Application]
disabled=0
index=*****

[WinEventLog://Security]
disabled=0
index=rhr_windows
blacklist=4674,5156

[WinEventLog://System]
disabled=0
index=*****

[WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=*****
renderXml=false

[WinEventLog://Microsoft-Windows-AppLocker/MSI and Script]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=*****
renderXml=false

[WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Deployment]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=*****
renderXml=false

[WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Execution]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index=*****

Re: Windows log going to the wrong sourcetype

So76 — Mon, 25 Apr 2022 13:02:33 GMT

Splunk Version 8.2 but HF is on 8.1.5

Re: Windows log going to the wrong sourcetype

VatsalJagani — Mon, 25 Apr 2022 13:06:08 GMT

Your configuration seems okay. I personally have not heard of any bug reported for Splunk that generates data in wrong sourcetypes.

You are also using the recent version of Splunk so that is even less likely to have that issue.

If you are sure that there are no props.conf or transforms.conf stanzas added/updated related to this data then you can contact Splunk support.

Re: Windows log going to the wrong sourcetype

So76 — Mon, 25 Apr 2022 13:10:58 GMT

Will contact splunk support

Re: Windows log going to the wrong sourcetype

isoutamo — Mon, 25 Apr 2022 14:17:39 GMT

One thing what you should still do is check those with btool on your HF (/UF).

# For inputs on source system HF or was it UF? splunk btool inputs list <stanza name here> --debug # And for sourcetypes on your HF splunk btool props list <sourcetype name here> --debug

That shows if there still is some other config files which overrides those settings.

r. Ismo

Re: Windows log going to the wrong sourcetype

So76 — Mon, 25 Apr 2022 14:20:35 GMT

Will run btool as suggested. Will get back to you