topic Re: Splunk Windows Events to Third Party System in Getting Data In

Splunk Windows Events to Third Party System

solman07 — Wed, 04 Sep 2024 12:40:26 GMT

Hello all, implementing some routing at the moment in order to forward a subset of data to a third party syslog system. However, i'm running into issues with the Windows Logs. They look like this at syslog-NG

Dec 29 07:47:18 12/29/2014 02:47:17 AM

Dec 29 07:47:18 LogName=Security

Dec 29 07:47:18 SourceName=Microsoft Windows security auditing.

Dec 29 07:47:18 EventCode=4689

Dec 29 07:47:18 EventType=0

I believe this is because of the /r/n in the Windows events caused by non-xml How can i get the Splunk Heavy Forwarder to treat each Windows event as one line and then send it through?

Architecture = UF - HF - Third Party System/Splunk Cloud

Thanks

Re: Splunk Windows Events to Third Party System

PickleRick — Wed, 04 Sep 2024 16:25:51 GMT

Windows logs are... tricky. Whichever way you want to peocess them. If you want to use third party solution that pushes to Splunk, you have tons of problems with parsing. If you want to use Splunk to forward events to a third party receiver you get issues like this.

Unfortunately, syslog receivers don't play nice with multiline events.

What you could try is change the format of windows events to xml (which is advised anyway), do a copy of your windows events with CLONE_SOURCETYPE, remove line ends from the event with a transform applied to that new sourcetype and route that sourcetype to your syslog output. Might work, might not, just an idea from the top of my head.