Getting Data In

Can i assign a sourcetype to Windows eventlogs ?

chimbudp
Contributor

I need to filter specific applcation eventlogs from Windows Server.

I am using light weight forwarder

I set the configurations as below . I am unable to get the results as expected.

Please suggest any modifications needed ?

From Universal Forwarder:
inputs.conf

[WinEventLog:Application]
disabled = 0
index = Server1_idx
interval = 300
sourcetype = Server1_EventLogs

From Indexer:
props.conf

[Server1_Eventlogs]
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD=30
LINE_BREAKER = ([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2}))
REPORT-MESSAGE = wel-message, wel-eq-kv, wel-col-kv
KV_MODE=none
TRANSFORMS-FIELDS = strip-winevt-linebreaker
TRANSFORMS-set=setnull,setparsing

transforms.conf

[setnull]
REGEX =  .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX =(?m)^EventCode=(5740|8112|1001)
DEST_KEY = queue
FORMAT = indexQueue
0 Karma
1 Solution

chimbudp
Contributor

I choose to go with scripted inputs. Here i can mention sourcetypes of my own.
using WMI Query i can filter specific eventlogs of my interest.

Sample:
Select * from Win32_NtLogEvent where LogFile = 'Application' AND EventCode ="xxx" OR EventCode="YYY"

View solution in original post

0 Karma

chimbudp
Contributor

I choose to go with scripted inputs. Here i can mention sourcetypes of my own.
using WMI Query i can filter specific eventlogs of my interest.

Sample:
Select * from Win32_NtLogEvent where LogFile = 'Application' AND EventCode ="xxx" OR EventCode="YYY"

0 Karma

linu1988
Champion

Hello,
No we can't as there are not valid attributes like source/sourcetype available for wineventlog in inputs.conf

We can however use

[Source::WinEventLog:Application] as source

Thanks

0 Karma

chimbudp
Contributor

By default the chosen stanza name for an input is prepended with 'source::' , i think we don't want to explicitly mention

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...