All Apps and Add-ons

Lookup File Lookup in props\transform

pfabrizi
Path Finder

We are using graylog to forward windows security events to SPLUNK, since we are using Enterprise Security and COM and we worked with SPLUNK PS to basically remap the fields from winlogbeat_ to format needed by the SPLUNK_TA_windows app. We have these working but are struggling with 1 lookup.

The field is 'action' with a value of "Action Success" or "Action Failure". However, when graylog sends it as [Action Success] or [Action Failure]. We changed the lookups file from splunk_ta_windows to [Action Success], success or [Action Failure],failure.

It doesn't appear to pull this from the lookup table. Is there a particular format when prefaced with a special character?

Here is what I tried:

[audit failure],failure
[Audit Failure],failure
"[AUDIT_FAILURE]",failure

Thanks!

Not sure if this is conflicting with the TA_Windows lookup or not, when I look at a btool I see that mine loaded, but I would think if I was using that one it would have broken the events coming in over the SPLUNK UF.

Tags (1)
0 Karma

FrankVl
Ultra Champion

Can you not update your extractions to strip off those square brackets before the lookup is applied?

0 Karma

pfabrizi
Path Finder

Thanks Frank, I did try that but was not successful. What my issue was the Splunk_TA_windows lookup was taking precedence so I just called it another name it works.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...