Getting Data In

Connectivity issues

VijaySrrie
Builder

Hi,

In Sandpit --> I have a multicluster environment created for testing

I have Windows Universal Forwarder --> From where I need to send sysmon logs to splunk

sysmon is successfully installed --> logging is enabled

In windows UF --> I have created inputs.conf and outputs.conf under Program Files --> SplunkUniversal forwarder--> etc--> system --> local

inputs.conf

[monitor://%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx]

index = main
sourcetype = web

 

outputs.conf

[tcpout]
defaultGroup=sysmon_server

[tcpout:sysmon_server]
server=FQDN:5986

 

Restarted the splunk

Added port 5986 into Heavy Forwarder of the clustered environment (9997 and 9998 ports were not getting connected to used 5986)

Index and sourcetype mentioned above are already there in HF.

--> Telnet is working

--> Phonehome logs are there

But sysmon logs are not getting ingested into splunk

 

0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @VijaySrrie 

sysmon add-on having it's own inputs to be configured as below that pulls logs automatically. Your explicit monitor does not work as .evtx files are binary.

Try following settings in inputs conf, same you can find in default/ dir of add-on.

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = true
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
# Prevent forwarding of multiple DNSQuery logs based on complex rule groups
# blacklist1 = EventCode="^22$" Message="(?i)QueryName:\s+(.*\.arpa\.)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\sysmon\.exe)$"
# blacklist2 = EventCode="^22$" Message="(?i)QueryName:\s+(HelloWorld.local)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\system32\\ping\.exe)$”

  ---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @VijaySrrie 

sysmon add-on having it's own inputs to be configured as below that pulls logs automatically. Your explicit monitor does not work as .evtx files are binary.

Try following settings in inputs conf, same you can find in default/ dir of add-on.

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = true
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
# Prevent forwarding of multiple DNSQuery logs based on complex rule groups
# blacklist1 = EventCode="^22$" Message="(?i)QueryName:\s+(.*\.arpa\.)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\sysmon\.exe)$"
# blacklist2 = EventCode="^22$" Message="(?i)QueryName:\s+(HelloWorld.local)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\system32\\ping\.exe)$”

  ---

An upvote would be appreciated and Accept solution if this reply helps!

Tags (1)
0 Karma

VijaySrrie
Builder

@venkatasri  its working ThanK you, do you have the doc from where you got the above config?

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@VijaySrrie  can't find splunk docs i referred add-on default/ dir for conf specs.

venkatasri
SplunkTrust
SplunkTrust

@VijaySrrie Copy the same contents to /local dir inputs conf and enable it add index that's all you need to do assuming your outputs conf are working you will be able to search logs with specified  default source.

--

An upvote would be appreciated if this reply helps!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...