All Apps and Add-ons

Does anyone else know how to WinEventLog:ForwardedEvents override?

dominiquevocat
Motivator

I guess we are not the only ones using Forwarding of WinEvents to a central server with an indexer. Does anyone else do it and use the windows infrstructure app?

We forward events and thus source and sourcetype is WinEventLog:ForwardedEvents
I guess we should override source and sourcetype based on the value in LogName. Has anyone done this and could you provide the necessary transforms? (could it be included in the app or a small TA companion for it?)

Labels (1)

md
Explorer

I know this is an old one, but I wanted to make sure this info is out there.

The Splunk Add-on for Microsoft Windows now handles this. Just add

host=WinEventLogForwardHost

to the [WinEventLog://ForwardedEvents] monitoring stanza.

0 Karma

WPB
New Member

@mikaelbje, you're a savior!

Many thanks for your help,
from the Splunkers at the City of West Palm Beach (FL).

0 Karma

Azeemering
Builder

Make sure you do what @delink  said:

Add the source too:

[Set-Source-By-LogName]
REGEX = (?m)LogName=(.*)?\b
FORMAT = source::WinEventLog:$1
DEST_KEY = MetaData:Source

0 Karma

mikaelbje
Motivator

Better late than never. I believe this should be sufficient:

Indexer config:
transforms.conf:

[Set-Host-By-ComputerName]
REGEX = (?m)ComputerName=(.*)?\b
FORMAT = host::$1
DEST_KEY = MetaData:Host

[Set-Sourcetype-By-LogName]
REGEX = (?m)LogName=(.*)?\b
FORMAT = sourcetype::WinEventLog:$1
DEST_KEY = MetaData:Sourcetype

props.conf:

[WinEventLog:ForwardedEvents]
TRANSFORMS-001-sethost_sourcetype = Set-Host-By-ComputerName, Set-Sourcetype-By-LogName

This retains the source value of WinEventLog:ForwardedEvents. You may have to override this too 🙂

Forwarder config:
inputs.conf:

[WinEventLog://ForwardedEvents]
sourcetype=WinEventLog:ForwardedEvents
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = windows
renderXml=false

delink
Communicator

Isn't WRITE_META = true needed when modifying these kinds of values in transforms?

Additionally, the "source" field is very important in windows event logs, so shouldn't there also be a transform for that here?

The props configuration should also reference the source rather than sourcetype to better work with version 5 and up of the Windows TA.

jcspigler2010
Path Finder

I know this question is coming up on a year old but mikaelbje, you are the MAN. I was in a pickle at a customer site with a stupid WEC server. This was PERFECT! Thanks for the awesome solution!

0 Karma

mikaelbje
Motivator

Glad to help 🙂

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...