Help with Extracting WinEventLog Fields

hfernandez_ — Fri, 12 Jun 2020 16:33:15 GMT

Hi Splunkers,

Has anyone seen this or something similar? We are collecting Windows Events Logs from Windows servers via a logging tool and they are being forwarded to a Splunk HF. Due to the logging system format, Splunk is not parsing the fields automatically.

Here is a sample event:

Jun 11 12:00:08 LOGGING-SERVER.domain.com 1 2020-06-11T19:00:03.529Z WINSVR001 - - - [Originator@6876 eventid="4624" task="Logon" keywords="Audit Success" level="Information" channel="Security" opcode="Info" eventrecordid="383694869" providername="Microsoft-Windows-Security-Auditing"] An account was successfully logged on. Subject: Security ID: S-1-5-20 Account Name: WINSVR001-V$ Account Domain: AD Logon ID: 0x3e4 Logon Type: 8 New Logon: Security ID: S-1-5-21-503695880-123456789-3595387526-4510 Account Name: jdoe Account Domain: AD Logon ID: 0x139c67d30 Logon GUID: {F325D620-6114-0657-01BF-F25C4AD21656} Process Information: Process ID: 0x3f8 Process Name: D:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\PopImap\Microsoft.Exchange.Imap4.exe Network Information: Workstation Name: WINSVR001-V Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0

We are using Splunk Add-on for Microsoft Windows 8.0. Is it possible to modify the existing conf files to have the fields parsed? Using the add-on with all the defined fields will integrate with CIM and ES nicely. I'm trying to avoid reinventing the wheel and doing a brute force regex on the whole event.

If you're up to the challenge, I'm looking for:

-Is it possible to modify the Splunk Add-on for Microsoft Windows 8.0 to recognize the above wineventlog format?

-Can some help me with the regex to parse all the wineventlog fields and values?

I appreciate the help in advance.

Thanks,

topic Help with Extracting WinEventLog Fields in Getting Data In

Help with Extracting WinEventLog Fields