Getting Data In

windows event Ids not parsing all events correctly

Engager

alt textWhen looking at windows event logs I notice that there are a lot of events that still have the and not this hinders my ability to table out different event ids.

I have tried to create a field extractor with the regx ">(?P\d+)<\/EventID>" as noted here https://visibleninja.guru/problemwith-eventid-field-extraction-in-windows_ta-app/.

This did not seem to parse out the event ids correctly. Where else should I put the regx key?

0 Karma
1 Solution

Esteemed Legend

You should be using the Splunk Add-on for Microsoft Windows AKA Splunk_TA_windows here:
https://splunkbase.splunk.com/app/742/
When you use this, all of the field extractions should be in place and work fine. If not, then open a support case with Splunk.

View solution in original post

0 Karma

Esteemed Legend

You should be using the Splunk Add-on for Microsoft Windows AKA Splunk_TA_windows here:
https://splunkbase.splunk.com/app/742/
When you use this, all of the field extractions should be in place and work fine. If not, then open a support case with Splunk.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

How are you ingesting the Windows Event logs? Have you taken a look at the docs for both getting data in the the Windows TA? The TA takes care of the extraction of all your needed fields.

Skalli

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!