Getting Data In

Problems with parsing Windows Event Log and CIM Model

KrumTym
Loves-to-Learn Lots

In some cases, I encounter problems with parsing data using CIM datamodel on windows event log data.

 

For example,  when searching for deleted and created user accounts using datamodel:

| from datamodel:"Change"."Account_Management" | search (action="created" OR action="deleted")

"User" field is calulated correctly for "created" 4720 events. 

This field calculation does not work correctly for 4726 events, where user and source user fields are returned as unknwon (even though they are present in raw log data). 

I am using Splunk TA for windows to ingest data. 

 

What may be the cause of this behavior? 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If a datamodel returns "unknown" for a field value it's because the expected field(s) were not found.  Perhaps the 4726 events are not tagged correctly.

---
If this reply helps you, Karma would be appreciated.
0 Karma

KrumTym
Loves-to-Learn Lots

Unfortunately, all the fields required are present in the raw event. The tags were also produced correctly. 

In this (quite old) thread https://community.splunk.com/t5/Splunk-Search/Define-user-field-in-Security-Essentials/m-p/312738 I've found an issue somehow connected to mine, as mine problems are also connected to the user and src_user field extraction and my AD server is also in a non-english language.

 

Has anyone found the underlying issue? 

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...