All Apps and Add-ons

Why is primary domain controller is only using a source and sourcetype of XML files?

brandoscommand0
Engager

Hello, 

I'm dealing with an issue for one of my forwarders. I have13 forwarders that are all showing in my search app in the proper format. For some reason, the forwarder that also happens to be our primary domain controller is only using a source and sourcetype of xml files. Is there a way to troubleshoot this?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is the search you are using to find the forwarders?

---
If this reply helps you, Karma would be appreciated.

brandoscommand0
Engager

Thanks for the reply. 

To be a little more precise, I'm having an issue with just Account Management event codes coming up from an .xml source. So for instance, my primary domain controller will show the results I want when I type something like:

index="main" sourcetype="wineventlog"  host="pdc" eventcode="4625" 

So I will get X amount of failed logins that populate. 

Now, when I type the same but add a "4720" for account created, nothing will populate. 
However, if I replace the event code search for a keyword of the account I created, it will populate with the account creation event happening, but in xml which is not ideal. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

When you say "add a 4720" do you really mean "replace?  Adding an eventcode would create something like

index=main sourcetype=wineventlog host=pdc eventcode=4625 eventoode=4720

which would produce no results because no Windows event has more than one event code.

---
If this reply helps you, Karma would be appreciated.
0 Karma

brandoscommand0
Engager

No, 

I would just have a singular event code showing. So for instance, I am able to see event code 4625 populate fine. However, any event code that has to do with account management (4720), does not populate and a more specific search only yields xml sources. 

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...