https://community.splunk.com/t5/Getting-Data-In/Syslog-Snare-WinEvent-and-Heavy-Forwarder-without-UF-on-syslog/m-p/535243#M89765 <P>So I'm trying to get to a HEC/syslog type environment. Please don't tell me that sending WinEvents via syslog is dumb. I have a global policy issue at work where all log data must be collected and stored in syslog for 2 years, and that includes my WinEvents. Here's my situation. I have a syslog-ng (3.13) server that receives Snare WIndows Events. It then sends on data to a splunk Heavy Forwarder (currently using the stock syslog "log {};" command). I've installed both the Snare Explanded Syslog TA and the Splunk_Windows TA (6.0) on the HF and the SH. I have also modified the inputs and props for the Windows TA to enable the data I want and do some cleanup (I did read setup for the Windows TA).<BR /><BR />However, my data in the SH is still listed with the correct host (in this example a domain controller), the source is the TCP port I'm receiving data on in splunk, and the sourcetype is syslog. Not snare_syslog, not winevent_syslog (or whatever that sourcetype is).<BR /><BR />I'm confused and stuck. Even if I migrate to a syslog-http-HEC environment (it's in dev right now) how do I get splunk to properly format the incoming data with extracted fields and the correct sourcetype in this design?</P> Fri, 08 Jan 2021 18:43:23 GMT mlinde 2021-01-08T18:43:23Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Snare-WinEvent-and-Heavy-Forwarder-without-UF-on-syslog/m-p/535243#M89765 <P>So I'm trying to get to a HEC/syslog type environment. Please don't tell me that sending WinEvents via syslog is dumb. I have a global policy issue at work where all log data must be collected and stored in syslog for 2 years, and that includes my WinEvents. Here's my situation. I have a syslog-ng (3.13) server that receives Snare WIndows Events. It then sends on data to a splunk Heavy Forwarder (currently using the stock syslog "log {};" command). I've installed both the Snare Explanded Syslog TA and the Splunk_Windows TA (6.0) on the HF and the SH. I have also modified the inputs and props for the Windows TA to enable the data I want and do some cleanup (I did read setup for the Windows TA).<BR /><BR />However, my data in the SH is still listed with the correct host (in this example a domain controller), the source is the TCP port I'm receiving data on in splunk, and the sourcetype is syslog. Not snare_syslog, not winevent_syslog (or whatever that sourcetype is).<BR /><BR />I'm confused and stuck. Even if I migrate to a syslog-http-HEC environment (it's in dev right now) how do I get splunk to properly format the incoming data with extracted fields and the correct sourcetype in this design?</P> Fri, 08 Jan 2021 18:43:23 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Snare-WinEvent-and-Heavy-Forwarder-without-UF-on-syslog/m-p/535243#M89765 mlinde 2021-01-08T18:43:23Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Snare-WinEvent-and-Heavy-Forwarder-without-UF-on-syslog/m-p/535245#M89766 <P>Also, I get no field extraction at all (I couldn't figure out how to go back and edit the original post)</P> Fri, 08 Jan 2021 18:44:40 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Snare-WinEvent-and-Heavy-Forwarder-without-UF-on-syslog/m-p/535245#M89766 mlinde 2021-01-08T18:44:40Z