topic Windows TA field extractions are not working in Splunk Search

Windows TA field extractions are not working

iainsmart — Wed, 25 Mar 2020 11:13:45 GMT

Hi,

When I search for Windows Event Logs using :
index=oswin sourcetype=XmlWinEventLog

I'm not getting any parsing/syntax highlighting or field extractions happening. The results are simply the raw XML. I have checked that I am in List format!

If I search for other indexes and sourcetypes I am getting correct parsing/syntax highlighting and extractions.

How can I go about finding out why this is happening and fix it?

Thanks,

Iain

Re: Windows TA field extractions are not working

richgalloway — Wed, 25 Mar 2020 14:32:33 GMT

Make sure you are in Verbose mode and that the Windows TA is installed on your search head.

Re: Windows TA field extractions are not working

iainsmart — Wed, 25 Mar 2020 16:25:19 GMT

I am in Verbose mode and the TA is installed on the search head

Re: Windows TA field extractions are not working

irievibe — Mon, 19 Jul 2021 21:02:42 GMT

I have the same problem and have TA everywhere and using verbose mode

The windows event viewer shows

...."Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
SYNCHRONIZE
ReadAttributes

Access Reasons: DELETE: Granted by D:(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)"

But in Splunk all I see is:

<Data Name='AccessList'>%%1537 %%1541 %%4423 </Data><Data Name='AccessReason'>%%1537: %%1801 😧(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)

I have many fields being parsed, but I don't even see "Accesss" in the raw data. It seems this is not being parsed correctly but also, Splunk isn't even able to read the data from Windows correctly to include Accesses: DELETE in the raw data

Re: Windows TA field extractions are not working

irievibe — Mon, 19 Jul 2021 23:27:07 GMT

I found that the Windows_TA app had the Security stanza disabled on my indexer. I had it set for forwarder and search head, but the indexer was misconfigured.
EventCode=4656 Accessed=DELETE works for me now