My Windows Event Log items are coming in as sourcetype=WinEventLog and not sourcetype=WinEventLog:Security as it set in my inputs.conf
# inputs.conf [WinEventLog://Security] source = WinEventLog:Security sourcetype=WinEventLog:Security disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" index = wineventlog renderXml=false
On my intermediate servers I have a props.conf file
[source::WinEventLog:Security] sourcetype=WinEventLog:Security TRANSFORMS-winsourceeventlogsecurity = route_stubhinfo_to_es [WinEventLog:Security] TRANSFORMS-wineventlogsecurity = route_stubhinfo_to_es #props.conf [route_stubhinfo_to_es] REGEX=.* DEST_KEY=_TCP_ROUTING FORMAT=lvssplunkes
My indexers do not have any props.conf settings.
My search heads do not have search time sourcetype renaming enabled.
Any idea where I might be messing up? How I can troubleshoot this farther?
You probably have Splunk TA Windows v5.0.0 installed, this does sourcetype transforms and as of version 5.0.0, sourcetype no longer includes the type of eventlog, it just says "WinEventLog". See also: http://docs.splunk.com/Documentation/WindowsAddOn/5.0.0/User/Upgrade#Source_and_sourcetype_changes_f...
I am not seeing anything that could cause that.
Splunk Add-on for Microsoft Windows version 4.8.4
Copyright (C) 2009-2016 Splunk Inc. All Rights Reserved.
For documentation, see: http://docs.splunk.com/Documentation/WindowsAddOn/latest
Are you sure you have 4.8.4 everywhere and not version 5?