topic Re: Windows Event Collection and Splunk in Getting Data In

Windows Event Collection and Splunk

rweales — Tue, 18 Jun 2019 15:43:04 GMT

So I have read many of the posts here regarding Window Event Collection and Splunk. So far I have not been able to find what I'm looking for, which is probably pretty basic stuff, but I haven't been able to get Splunk to do what I need.

Here are my questions:

How do I get Splunk to override the host with the computername? I have tried setting this up in props and transforms on my Indexer(not the WE Collector server running the Universal Forwarder). I copied the props and transforms to /splunk/etc/system/local and edited those, as per the warning in the files. I assume that is the correct location for those files. I have tried both of these(one at a time) and neither worked.

Am I supposed to be setting this up on the indexer or on the WEC server where the Forwarder is installed?

   [WinEventLog:*]
   TRANSFORMS-change_host =
   WinEventHostOverride

   [(?:::){0}WinEventLog:...]
   TRANSFORMS-FixWinEventLogHost =
   WinEventLog-SetForwarderName,WinEventLog-SetOriginatingHost

When my WEC server receives security events from various Windows boxes, those events get forwarded to Splunk, however, they show up as coming from the WEC server, not from the individual computername.
Is it possible to get the Universal Forwarder to NOT FORWARD all of its Metrics info, etc; When I do a search in Splunk for things from my WEC server I see page after page of this.

When I install the Forwarder, should I be selecting "Forwarded Events" and "Security Events" or just one or the other? I only want Security Events, however, they are forwarded from other systems.

Thanks for any assistance!

Re: Windows Event Collection and Splunk

richgalloway — Wed, 19 Jun 2019 13:29:30 GMT

Perhaps it's how things are re-formatted by the forum, but attributes and values in props.conf should be on the same line, as in TRANSFORMS-change_host = WinEventHostOverride.
Also, please provide your related transforms.conf stanzas and some sample data.

Re: Windows Event Collection and Splunk

FrankVl — Wed, 19 Jun 2019 13:55:17 GMT

What @richgalloway says.

As for your last 2 additional questions: yes, you can limit what the UF forwards in the sense of internal logs. You need to change the inputs.conf settings for the respective sources for that. But I would recommend keeping that, as it can become very useful when debugging and is also needed for proper functioning of your Monitoring Console for example.

I would say you want to select both forwarded events and security events. As you want the events forwarded to you WEC host as well as the WEC host's own local security logs, right?

Re: Windows Event Collection and Splunk

rweales — Wed, 19 Jun 2019 21:44:24 GMT

Yes, the forum formatting is the reason those lines look that way.
Right now I am unconcerned as much with debugging output from splunkd that comes over.
Yes, I have both Security and Forwarded events going from my WEC/Universal Forwarder server to the Indexer.

I have tried a few different ways to get the host field to show what the computername field shows. As I understand it this is possible to do with forwarded events. So far I have not been able to get Splunk to do this...

entry in splunk/etc/system/local/props.conf:
[source::WinEventLog:*]
TRANSFORMS-change_host = WinEventHostOverride

entry in splunk/etc/system/local/transforms.conf
[WinEventHostOverride]
DEST_KEY = MetaData:Host
REGEX = (?m)^ComputerName=([\S]*)
FORMAT = host::$1

What am I missing?