topic Re: In Windows Security logs, why does Splunk incorrectly solves some data? in Getting Data In

In Windows Security logs, why does Splunk incorrectly solves some data?

patriziadepaola — Mon, 23 Jan 2017 08:36:17 GMT

Good morning,
I noticed that Splunk (v. 6.5.1) does not properly report some fields of security event logs collected.
In the example, the value in the field "Accesses" of my Windows security log is : “ReadData (or ListDirectory)” but in the result of search in splunk I have : "%9"

And, unfortunately, also other fields are affected by the same problem!

Can someone help me?!
Thank you!

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

gcusello — Mon, 23 Jan 2017 09:13:17 GMT

Hi patriziadepaola,
you should verify in Windows EventViewer if you have the same values.
I think that you should find the problem in Windows Event Logging, because Splunk acquires Windows Logs without modifying them.
Bye.
Giuseppe

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

patriziadepaola — Mon, 23 Jan 2017 09:35:21 GMT

No, unfortunately, in the windows log contain the correct messages! In the example that I had submitted, windows security log for string Accesses presents the value "ReadData (or ListDirectory)", but my search in splunk returns %9

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

gcusello — Mon, 23 Jan 2017 11:14:13 GMT

Hi patrizia,
how you took logs, using TA_Windows Security Stanza?

[WinEventLog://Security]
disabled = 1
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5

and sourcetype=WinEventLog:Security?

Bye.
Giuseppe

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

patriziadepaola — Tue, 29 Sep 2020 12:31:46 GMT

Hi Giuseppe, no I don't use soucetype=WinEventLog:Security
this is my inputs.conf:

[WinEventLog://ForwardedEvents]
disabled = 1
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = security
_TCP_ROUTING= collaudo

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

gcusello — Mon, 23 Jan 2017 12:45:47 GMT

Hi patrizia,
You should try to use this sourcetype, because Splunk gives by default all the Windows configurations to ingest this logs.
Otherwise, you should search in Splunk_TA-Windows props.conf file extracting all the configurations for WinEventLog:Security (you can find in "###### Windows Security Event Log ######" section).
But Every Way I suggest to you to use the default sourcetype, it's easier!

Bye.
Giuseppe

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

gcusello — Tue, 24 Jan 2017 07:36:59 GMT

Hi Patrizia,
if you don't want to use this sourcetype, you have to rebuild all the WinEventLog:Security environment in your sourcetype.
See in Splunk_TA-Windows props.conf file what are all the configurations for WinEventLog:Security (you can find in "###### Windows Security Event Log ######" section) and rebuild them for your sourcetype.
Bye.
Giuseppe

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

woodcock — Wed, 25 Jan 2017 18:13:09 GMT

You need 2 things: you need AD (Domain Controller) setup correctly and you need this setting in your inputs.conf:

evt_resolve_ad_obj = 1

Read here (and elsewhere) for more:
https://answers.splunk.com/answers/23502/windows-sid-resolving-in-splunk.html

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

patriziadepaola — Fri, 27 Jan 2017 08:35:24 GMT

Hi Giuseppe, using TA_Windows Security Stanza with soucetype WinEventLog:Security all woks fine!
Thank you.

Re: In Windows Security logs, why does Splunk incorrectly solves some data?

gcusello — Fri, 27 Jan 2017 08:42:12 GMT

If this answer solves your question, please accept it.
bye.
Giuseppe