topic Re: Help me find where my sourcetype is getting broken ? in Getting Data In

Help me find where my sourcetype is getting broken ?

daniel333 — Wed, 05 Sep 2018 02:47:13 GMT

All,

My Windows Event Log items are coming in as sourcetype=WinEventLog and not sourcetype=WinEventLog:Security as it set in my inputs.conf

# inputs.conf
[WinEventLog://Security]
  source = WinEventLog:Security
  sourcetype=WinEventLog:Security
  disabled = 0
  start_from = oldest
  current_only = 0
  evt_resolve_ad_obj = 1
  checkpointInterval = 5
  blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
  blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
  index = wineventlog
  renderXml=false

On my intermediate servers I have a props.conf file

[source::WinEventLog:Security]
  sourcetype=WinEventLog:Security
  TRANSFORMS-winsourceeventlogsecurity = route_stubhinfo_to_es

[WinEventLog:Security]
 TRANSFORMS-wineventlogsecurity = route_stubhinfo_to_es
#props.conf
[route_stubhinfo_to_es]
  REGEX=.*
  DEST_KEY=_TCP_ROUTING
  FORMAT=lvssplunkes

My indexers do not have any props.conf settings.
My search heads do not have search time sourcetype renaming enabled.

Any idea where I might be messing up? How I can troubleshoot this farther?

Re: Help me find where my sourcetype is getting broken ?

FrankVl — Wed, 05 Sep 2018 07:20:28 GMT

You probably have Splunk TA Windows v5.0.0 installed, this does sourcetype transforms and as of version 5.0.0, sourcetype no longer includes the type of eventlog, it just says "WinEventLog". See also: http://docs.splunk.com/Documentation/WindowsAddOn/5.0.0/User/Upgrade#Source_and_sourcetype_changes_for_WinEventLog_data

Re: Help me find where my sourcetype is getting broken ?

daniel333 — Wed, 05 Sep 2018 19:08:38 GMT

I am not seeing anything that could cause that.

For documentation, see: http://docs.splunk.com/Documentation/WindowsAddOn/latest

Re: Help me find where my sourcetype is getting broken ?

FrankVl — Thu, 06 Sep 2018 09:03:14 GMT

Are you sure you have 4.8.4 everywhere and not version 5?