Windows Netstat

[rmsit]

Hi all,

I'm using the winports app to index the result of the netstat -ano on my Windows servers. A few months ago the results displayed the various values under the LocalPort field, however, now only the first 3 ports show. I'm thinking that a Splunk upgrade may be the cause. Is there any way to correct this? There should be several more ports available.

Sample Event:
7/2/17
3:51:11.000 PM

2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="135" Remo
teAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID=
"704"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="445" Remo
teAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="
4"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="1433" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="sqlservr" PI
D="1284"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="3389" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID
="1824"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="4445" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="enstart64" P
ID="1160"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="8089" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="splunkd" PID
="1596"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="10000" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="beremote" P
ID="2020"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="47001" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID
="4"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49152" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="wininit" PI
D="424"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49153" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PI
D="796"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49154" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PI
D="836"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="53108" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="lsass" PID=
"540"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="53130" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="services" P
ID="532"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="127.0.0.1" LocalPort="1434" R
emoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="sqlservr"
PID="1284"

LocalPort Values:
Values Count %

135 145 63.596%

80 79 34.649%

25 4 1.754%

Thanks,
James

[rmsit · Accepted solution]

Thanks. It works now. I had to change my sourcetype too as netstat was used elsewhere. There was actually no need to modify props.conf.

[script://.\bin\winports.bat]
disabled = 0
interval = 300
sourcetype = winports and not netstat - which is used by Unix app
source = Script:Winports

[sbrice17]

Been messing with this today!

1. Create a props.conf file in your local directory with your input

2. Add this to your props.conf
   [ winstat ]
   CHARSET=UTF-8
   SHOULD_LINEMERGE=true
   disabled=false

3. redeploy app or restart forwarder depending on your setup.

4. I had to change the sourcetype to "winstat" since I am using netstat elsewhere. Both on the inputs.conf and props.conf.

I am now seeing the events being listed individually and all the fields are now populating.