[WinEventLog://Security] logs to Splunk

[Murali]

Hello guys,

I have [WinEventLog://Security] inputs.conf  setup.

However , I would like to see the machine/server type and OS type in the index which is currently not there.

How can I bring this data in. I have checked the raw data and no such infomation.

Your thoughts?  Thanks in advance.

Cheers..

Regards

[PickleRick]

As @venkatasri already pointed out - you can't just conjure data out of thin air - if the original event doesn't include the information (and typically it doesn't - why should it? You don't need the extra amount of wasted storage only to have the information which you typically should have otherwise).

And your windows admin will most probably _not_ be able to force windows to include such info in the logs (again - why should windows send that in the event?).

Typically, in all kinds of monitoring software you usually have some form of an asset database separate from the events themselves and a method of correlating the source identified from the event with the data in said database. In case of plain Splunk Enterprise you  can gather such info in a lookup table and dynamically enrich your data on search. If you have Enterprise Security, there are additional options of having such asset db created (semi-)automatically for you.

[venkatasri]

Hi @Murali 

If you can't find Type/ OS in Windows Security Event logs that are ingested to Splunk, that is likely due to the source windows machines do not have such information exist in event logs.

You could talk to Windows Administrator to include the desired details on Windows machine that you wanted for Splunk to collect and ingest.

Hope this helps! 

-------------------------

Srikanth Yarlagadda.

[Murali]

Thanks for the suggestion Sri. Will try it out.

Cheers..

Regards

Murali