Getting Data In

Problems with parsing Windows Event Log and CIM Model

KrumTym
Loves-to-Learn Lots

In some cases, I encounter problems with parsing data using CIM datamodel on windows event log data.

 

For example,  when searching for deleted and created user accounts using datamodel:

| from datamodel:"Change"."Account_Management" | search (action="created" OR action="deleted")

"User" field is calulated correctly for "created" 4720 events. 

This field calculation does not work correctly for 4726 events, where user and source user fields are returned as unknwon (even though they are present in raw log data). 

I am using Splunk TA for windows to ingest data. 

 

What may be the cause of this behavior? 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If a datamodel returns "unknown" for a field value it's because the expected field(s) were not found.  Perhaps the 4726 events are not tagged correctly.

---
If this reply helps you, Karma would be appreciated.
0 Karma

KrumTym
Loves-to-Learn Lots

Unfortunately, all the fields required are present in the raw event. The tags were also produced correctly. 

In this (quite old) thread https://community.splunk.com/t5/Splunk-Search/Define-user-field-in-Security-Essentials/m-p/312738 I've found an issue somehow connected to mine, as mine problems are also connected to the user and src_user field extraction and my AD server is also in a non-english language.

 

Has anyone found the underlying issue? 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...