topic Re: Splunk Enterprise Security and Splunk Add-On for Windows in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-and-Splunk-Add-On-for-Windows/m-p/427600#M5472 <P>is there a question here?<BR /> what is the version of the windows TA you are using?<BR /> iirc, the 5.0 version has those bugs and it says somewhere in the docs to go back to 4.8.4</P> Tue, 11 Dec 2018 01:42:42 GMT adonio 2018-12-11T01:42:42Z Splunk Enterprise Security and Splunk Add-On for Windows https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-and-Splunk-Add-On-for-Windows/m-p/427599#M5471 <P>As best as I can tell there is a bug between the Splunk Enterprise Security App and Splunk Add-On for Windows. The Splunk Enterprise Security App Windows Event Log Cleared looks for sourcetype=wineventlog:security. However the Splunk Add-On for Windows props file that renames wineventlog:security back to wineventlog causing the Windows Event Log Cleared to never fire.</P> <P>Additionally, the transform regex may be wrong, not sure, could not get it to fire as written so I created a custom transform, (?m)^LogName=(\S+).</P> Mon, 10 Dec 2018 20:16:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-and-Splunk-Add-On-for-Windows/m-p/427599#M5471 jeburkes76 2018-12-10T20:16:15Z Re: Splunk Enterprise Security and Splunk Add-On for Windows https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-and-Splunk-Add-On-for-Windows/m-p/427600#M5472 <P>is there a question here?<BR /> what is the version of the windows TA you are using?<BR /> iirc, the 5.0 version has those bugs and it says somewhere in the docs to go back to 4.8.4</P> Tue, 11 Dec 2018 01:42:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-and-Splunk-Add-On-for-Windows/m-p/427600#M5472 adonio 2018-12-11T01:42:42Z Re: Splunk Enterprise Security and Splunk Add-On for Windows https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-and-Splunk-Add-On-for-Windows/m-p/427601#M5473 <P>I guess sort of a question, I am new to transforms and props configuration files so it was a sanity check. Maybe my team and I made a mistake and installed a later version of the Add-On for Microsoft version 5.0.1 but we believe it came with ES 5.20 when we installed hence our confusion and concern if it is a known issue. This is a test environment so maybe we missed something. Thanks for the info.</P> Fri, 14 Dec 2018 12:38:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-and-Splunk-Add-On-for-Windows/m-p/427601#M5473 jeburkes76 2018-12-14T12:38:34Z