Universal Forwarder fails to forward important portions of windows events

[dstaulcu]

It looks like splunk (up to version 6.2) is forwarding general message data, but not optional data written in schema of log for detail data. Microsoft and 3rd party applications are providing analytic gold the details for some logs. Microsoft extended the schema of events logs to allow storage of additional detail in Windows Vista.

Short of writing custom input scripts, is there a input specification I am missing to turn this on that would result in forwarding of the remainder of event log data? Are there any known plans to correct this?

[WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL]
_rcvbuf = 1572864
baseline = 0
checkpointInterval = 5
current_only = false
disabled = 0
evt_dc_name = somednsdomain.com
evt_dns_name = somednsdomain.com
evt_resolve_ad_obj = 0
host = host1
index = default
interval = 60

Classic

Mainstream

[dstaulcu · Accepted solution]

Good news!

Our account rep informed me today that events can alternatively be forwarded in their XML based structure with Splunk 6.2.

To do so you can add renderXml = true to the associated input stanza. At first I thought it wasn't working as I had my search filtered on the soucetype. Turns out the sourcetype changes when you enable the feature. XML is prepended to the default sourcetype name.

This new feature is not documented in release notes for 6.2 but it is mentioned in the getting data in guide for 6.2 as well at it's inputs.conf.spec.

Now the challenge will be determine most efficient method to split events out.