Getting Data In

XmlWinEventLog:Security events ::ffff: Remove SED props not working

vemurisurya
Path Finder

Hi
We are collecting the winevent logs in XML format since enabled ipv6 on the DC we are getting src_ip with included ipv6 and IP.
When I am trying to remove the ipv6 (::ffff:) from the src_ip and parse only IP address.

Neither of my props works.

[XmlWinEventLog]
SEDCMD-remove_ffff = s/(?ms)(.*IpAddress\'\>)(::ffff:)(.*)/\1\3/g

[XmlWinEventLog]
SEDCMD-ipaddresssed = s/(::ffff:)//g

My actual event.

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5434-4994-A5BA-3E3B0328C30D}'/><EventID>4769</EventID><Version>0</Version><Level>0</Level><Task>14337</Task><Opcode>0</Opcode><Keywords>0x80200000000000</Keywords><TimeCreated SystemTime='2019-08-07T20:59:39.371042600Z'/><EventRecordID>93547806</EventRecordID><Correlation/><Execution ProcessID='704' ThreadID='1468'/><Channel>Security</Channel><Computer>dcserver.prog.com</Computer><Security/></System><EventData><Data Name='TargetUserName'>dvtest@prog.COM</Data><Data Name='TargetDomainName'>prog.COM</Data><Data Name='ServiceName'>dctest$</Data><Data Name='ServiceSid'>progtest\devtest$</Data><Data Name='TicketOptions'>0x40810000</Data><Data Name='TicketEncryptionType'>0x12</Data><Data Name='IpAddress'>::ffff:10.0.192.53</Data><Data Name='IpPort'>58774</Data><Data Name='Status'>0x0</Data><Data Name='LogonGuid'>{CA2F0CA9-78F8-0F8F-EAA1-269FE090D582}</Data><Data Name='TransmittedServices'>- </Data></EventData></Event> 
0 Karma

vemurisurya
Path Finder

they did all Windows TA App source definitions filed changes on WinEventLog:Security source name , and finally they renamed the source as XmlWinEventLog:Security may be that's the reason my confs are not working.
now i had change my confs by removing the XML from the source OR sourcetype

> [source::WinEventLog:Security]
> SEDCMD-remove_ffff = s/(::ffff:)//g
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...