All Apps and Add-ons

Parsing AWS Managed Active Directory logs

sun1000
Path Finder

Hi Team,

Need help in parsing AWS Managed Active Directory

AD Team is writing logs to cloudwatch, and we have Splunk Addon for AWS which consumes these logs through Kinesis stream. 
I have props config to convert the logs to xmlwineventlog sourcetype after which data is parsed but not all the fields. I want the addon to parse using the source [xmlwineventlog:security] but that is not happening,

 

Here is my props config

[source://*securitylogs]
Transforms-Index=override_st_props,override_source_props

And transforms as below

[override_st_props]
REGEX=.
FORMAT = sourcetype::xmlwineventlog
DEST_KEY = MetaData:Sourcetype

[override_source_props]
REGEX = .
FORMAT = source::xmlwineventlog:security
DEST_KEY = MetaData:Source

It is getting changed on sourcetype and source, but parsing is happening based on sourcetype as per windows addon and not on source

Hope i made it clear, please help

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...