topic Re: Problems with parsing Windows Event Log and CIM Model in Getting Data In

Problems with parsing Windows Event Log and CIM Model

KrumTym — Mon, 16 Oct 2023 11:49:17 GMT

In some cases, I encounter problems with parsing data using CIM datamodel on windows event log data.

For example, when searching for deleted and created user accounts using datamodel:

| from datamodel:"Change"."Account_Management" | search (action="created" OR action="deleted")

"User" field is calulated correctly for "created" 4720 events.

This field calculation does not work correctly for 4726 events, where user and source user fields are returned as unknwon (even though they are present in raw log data).

I am using Splunk TA for windows to ingest data.

What may be the cause of this behavior?

Re: Problems with parsing Windows Event Log and CIM Model

richgalloway — Tue, 17 Oct 2023 12:22:20 GMT

If a datamodel returns "unknown" for a field value it's because the expected field(s) were not found. Perhaps the 4726 events are not tagged correctly.

Re: Problems with parsing Windows Event Log and CIM Model

KrumTym — Fri, 12 Apr 2024 12:58:59 GMT

Unfortunately, all the fields required are present in the raw event. The tags were also produced correctly.

In this (quite old) thread https://community.splunk.com/t5/Splunk-Search/Define-user-field-in-Security-Essentials/m-p/312738 I've found an issue somehow connected to mine, as mine problems are also connected to the user and src_user field extraction and my AD server is also in a non-english language.

Has anyone found the underlying issue?