Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: AWS windows logs parsing
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
How we can distinguish windows/linux logs from the AWS logs. Is there any TA/App is available which support by splunk?
Same query for AZURE & GCP(Goole Cloud Platform)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Windows logs have a different sourcetype from Linux.
If you install both the Windows and Linux TA on the machines it will put the data into the appropriate sourcetypes for you.
If however you are talking about EC2 cloud trail/cloud watch etc, you will need to look at the data carefully, because when ec2 reports metrics it has no concept of the instance OS.
See the following Apps for more info:
Windows/Linux
https://splunkbase.splunk.com/app/742/
https://splunkbase.splunk.com/app/833/
AWS:
https://splunkbase.splunk.com/app/1876/
https://splunkbase.splunk.com/app/1274/
Azure/GCP:
https://splunkbase.splunk.com/app/3110/
https://splunkbase.splunk.com/app/3088/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Windows logs have a different sourcetype from Linux.
If you install both the Windows and Linux TA on the machines it will put the data into the appropriate sourcetypes for you.
If however you are talking about EC2 cloud trail/cloud watch etc, you will need to look at the data carefully, because when ec2 reports metrics it has no concept of the instance OS.
See the following Apps for more info:
Windows/Linux
https://splunkbase.splunk.com/app/742/
https://splunkbase.splunk.com/app/833/
AWS:
https://splunkbase.splunk.com/app/1876/
https://splunkbase.splunk.com/app/1274/
Azure/GCP:
https://splunkbase.splunk.com/app/3110/
https://splunkbase.splunk.com/app/3088/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the clarification about cloudtrail/cloudwatch logs.
In cloudwatch logs suppose I am getting failed login events which same as windows logs (event id 4625). So it should be parsed as a windows parsing?
If yes then it would be done by AWS splunk app?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Meet the .conf26 AI Agent Buildathon Winners
Trusted Autonomy in the SOC: A Maturity Journey
Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...
