Getting Data In

Splunk Windows Events to Third Party System

solman07
New Member

Hello all, implementing some routing at the moment in order to forward a subset of data to a third party syslog system. However, i'm running into issues with the Windows Logs. They look like this at syslog-NG 

Dec 29 07:47:18 12/29/2014 02:47:17 AM

Dec 29 07:47:18 LogName=Security

Dec 29 07:47:18 SourceName=Microsoft Windows security auditing.

Dec 29 07:47:18 EventCode=4689

Dec 29 07:47:18 EventType=0

 

I believe this is because of the /r/n in the Windows events caused by non-xml  How can i get the Splunk Heavy Forwarder to treat each Windows event as one line and then send it through? 

Architecture = UF - HF - Third Party System/Splunk Cloud 

Thanks 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Windows logs are... tricky. Whichever way you want to peocess them. If you want to use third party solution that pushes to Splunk, you have tons of problems with parsing. If you want to use Splunk to forward events to a third party receiver you get issues like this.

Unfortunately, syslog receivers don't play nice with multiline events.

What you could try is change the format of windows events to xml (which is advised anyway), do a copy of your windows events with CLONE_SOURCETYPE, remove line ends from the event with a transform applied to that new sourcetype and route that sourcetype to your syslog output. Might work, might not, just an idea from the top of my head.

0 Karma
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...