Getting Data In

How does a LOOKUP and Report command work in a PROPS.CONF ?

pfabrizi
Path Finder

We have to use Graylog to forward Windows events to our SPLUNK. However we are trying to use CIM model and we have asked the graylog folks to alias some fields. I have been looking at the props.conf from the slunk_ta_windows app and asking our graylog folks to alias the fields to match those in the TA_windows app, which as long as I set the source and source type to wineventlog:security they appear to be working. But I am trying to understand these commands and what they do?

LOOKUP-action_for_windows0_security = windows_audit_changes_lookup EventCode OUTPUTNEW action,change_type,object_category
REPORT-privilege_id_for_windows_security = privilege_id_for_windows_security

Once I can understand these I can probably get closer to all the fields I need graylog to send.

Thanks!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...