Getting Data In
Highlighted

_TCP _ROUTING - windows event – will this work?

New Member

Hi
I was wondering how you go about extracting and forwarding certain field values to a third party system and whether the below would work.

The goal is to extract a few field values (timestamp, username and IP) from WindowsEventID4624 and forward them to ‘device1’. EventID462 must also be stored on the indexer. The app below would be installed on the indexer.

outputs.conf:
[tcpout:Device1]
server = 1.1.1.1.1:5514
sendCookedData = false

props.conf:
[WinEventLog:Security]
TRANSFORMS-foo = WinEventID4624

transforms.conf:
[WinEventID4624]
REGEX = (?gmsi)(\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\s(?:PM|AM)?).*EventCode=\b4624\b.*Account Name:\s*([^\r\n\@]\S+).*?Source\sNetwork\sAddress:\s(?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
DESTKEY = _TCPROUTING
FORMAT = Time::$1,AccountName::$2,IP::$3

Thanks!

0 Karma
Highlighted

Re: _TCP _ROUTING - windows event – will this work?

SplunkTrust
SplunkTrust

I don't think something like that is possible (sending only specific portion/fields to third party system). The transforms.conf you've, the FORMAT should provide the value for the attribute defined by DESTKEY, and probably won't do anything (may be few warning/errors in internal logs). You would be able to send the whole raw log for a particular event code (based on regex specified in REGEX) to a third party system where you'd specify the _TCPROUTING group for that system in your FORMAT setting.

0 Karma