All Apps and Add-ons

When using Splunk App for Windows Infrastructure, do you have any recommendations for non-English Windows server logs?

aroos
New Member

Hello there,

Official documentation states

Microsoft Windows event logs that are rendered in XML format will not populate in the Splunk App for Windows Infrastructure

and props.conf makes regex on english sentences:

 [source::WinEventLog:Security]
EXTRACT-4625-fields = (?ms)EventCode=4625.*?Message=.*?\n.*?Subject\s*:.*?Account Name:\s*(?.*?)\n.*?Account  Domain:\s*(?.*?)\n.*?Logon ID:\s*(?.*?)\n.*?\nLogon Type:.*?\n.*?Account For Which Logon Failed.*?\n.*?Security ID:(?.*?)\n.*?Account Name:(?.*?)\n.*?Account Domain:(?.*?)\n
EXTRACT-4624-srcip = (?ms)EventCode=4624\n.*?Source Network Address:\s+?(?[^\n]+)
EXTRACT-4624-user = (?ms)New Logon:\n*?.*?Security ID:\s*?(?[^\\]+)\\(?.*?)\n.*?Account Name:(?.*?)\s*\n.*?Account Domain:\s+(?[^\n]+).*?Logon ID:\s+(?[^\n]+)

...

How do I deal with non-English Windows event logs? i didn't see any language requirements in documentation.

Thx
Anthony

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...