Getting Data In

windows_snare_syslog sourcetype but no field extractions?

Runals
Motivator

Perhaps I was over thinking this when I set a sourcetype to windows_snare_syslog - are there no field extractions build "out of the box" so to speak? We are running v5

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Ayn
Legend

Runals
Motivator

Thanks Ayn. I had seen that but the word "expanded" in the description implied to me that there might be some additional out of the box field extractions for snare that I wasn't seeing for whatever reason. Guess not; will check it out.

0 Karma

Runals
Motivator

I did just look and am seeing that. The disappointing thing is the syslog-extractions in the transforms.conf is just for process and pid. Had hoped for more value from this sourcetype w/o me having to develop it =).

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Over here there is a field extraction windows_snare_syslog : REPORT-syslog that maps to the field transformation syslog-extractions.

Are you not seeing that, or is that not doing what you expected?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...