All Apps and Add-ons

Parsing AWS Managed Active Directory logs

Path Finder

Hi Team,

Need help in parsing AWS Managed Active Directory

AD Team is writing logs to cloudwatch, and we have Splunk Addon for AWS which consumes these logs through Kinesis stream. 
I have props config to convert the logs to xmlwineventlog sourcetype after which data is parsed but not all the fields. I want the addon to parse using the source [xmlwineventlog:security] but that is not happening,


Here is my props config


And transforms as below

FORMAT = sourcetype::xmlwineventlog
DEST_KEY = MetaData:Sourcetype

FORMAT = source::xmlwineventlog:security
DEST_KEY = MetaData:Source

It is getting changed on sourcetype and source, but parsing is happening based on sourcetype as per windows addon and not on source

Hope i made it clear, please help

Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...