Getting Data In

Help me find where my sourcetype is getting broken ?



My Windows Event Log items are coming in as sourcetype=WinEventLog and not sourcetype=WinEventLog:Security as it set in my inputs.conf

# inputs.conf
  source = WinEventLog:Security
  disabled = 0
  start_from = oldest
  current_only = 0
  evt_resolve_ad_obj = 1
  checkpointInterval = 5
  blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
  blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
  index = wineventlog

On my intermediate servers I have a props.conf file

  TRANSFORMS-winsourceeventlogsecurity = route_stubhinfo_to_es

 TRANSFORMS-wineventlogsecurity = route_stubhinfo_to_es

My indexers do not have any props.conf settings.
My search heads do not have search time sourcetype renaming enabled.

Any idea where I might be messing up? How I can troubleshoot this farther?

0 Karma

Ultra Champion

You probably have Splunk TA Windows v5.0.0 installed, this does sourcetype transforms and as of version 5.0.0, sourcetype no longer includes the type of eventlog, it just says "WinEventLog". See also:

0 Karma


I am not seeing anything that could cause that.

Splunk Add-on for Microsoft Windows version 4.8.4
Copyright (C) 2009-2016 Splunk Inc. All Rights Reserved.

For documentation, see:

0 Karma

Ultra Champion

Are you sure you have 4.8.4 everywhere and not version 5?

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...