Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to process event exact same for events fro...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let us say you have following lines in your props.conf file:
[WinEventLog:Security]
REPORT-common = user-account-change
REPORT-win-2k3 = group-type-change
You have another event source type ABC which generates exact same events as WinEvnetLog:Security so you want to apply the same transforms to it. You can do so by adding following lines to your props.conf file:
[ABC]
REPORT-common = user-account-change
REPORT-win-2k3 = group-type-change
This duplicates these REPORT-* entries. Is it possible to support more than one source types in props.conf for the same transform items? An example is:
[WinEventLog:Security],[ABC]
REPORT-common = user-account-change
REPORT-win-2k3 = group-type-change
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The type of re-use you're talking about does occur in the transforms. While it's true that you have to reference each transform (i.e., "user-account-change") for each applicable sourcetype in props.conf, you're reusing the regular expression rule itself which appears in transforms.conf. Specifically with regards to Windows Event Logs, you might consider checking the source of these events in your results. It may be possible to use a single props.conf stanza (like [source::(WMI:WinEventLog|WinEventLog)...] based on source--think input path). An example of this is found in the Splunk for Windows Technology Add-on.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The type of re-use you're talking about does occur in the transforms. While it's true that you have to reference each transform (i.e., "user-account-change") for each applicable sourcetype in props.conf, you're reusing the regular expression rule itself which appears in transforms.conf. Specifically with regards to Windows Event Logs, you might consider checking the source of these events in your results. It may be possible to use a single props.conf stanza (like [source::(WMI:WinEventLog|WinEventLog)...] based on source--think input path). An example of this is found in the Splunk for Windows Technology Add-on.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No problem. Note that it seems that the "..." is only available for matches beginning with [source: ], kind of like using ... in inputs.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[source::(WMI:WinEventLog|WinEventLog)...] is working for me.
I tried using regex yesterday and were not lucky. The ... is the key to work.
Thanks a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The WMI:WinEventLog:Security has exact same events as WinEventLog:Security.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To the best of my knowledge that is not possible. Also, as far as I know, there are no other applications than the Windows OS that produce the same kind of events as WinEventLog:Security.
Are you sure that you should have different sourcetypes for this data? If the format of the events are the same, then it generally IS the same sourcetype. That is pretty much the idea behind sourcetypes. Then you can have just one props.conf stanza.
/kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The WMI:WinEventLog:Security has exact same events as WinEventLog:Security.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
