Splunk Search

AWS windows logs parsing

N92
Path Finder

Hi,

How we can distinguish windows/linux logs from the AWS logs. Is there any TA/App is available which support by splunk?

Same query for AZURE & GCP(Goole Cloud Platform)?

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Windows logs have a different sourcetype from Linux.
If you install both the Windows and Linux TA on the machines it will put the data into the appropriate sourcetypes for you.

If however you are talking about EC2 cloud trail/cloud watch etc, you will need to look at the data carefully, because when ec2 reports metrics it has no concept of the instance OS.

See the following Apps for more info:
Windows/Linux
https://splunkbase.splunk.com/app/742/
https://splunkbase.splunk.com/app/833/

AWS:
https://splunkbase.splunk.com/app/1876/
https://splunkbase.splunk.com/app/1274/

Azure/GCP:
https://splunkbase.splunk.com/app/3110/
https://splunkbase.splunk.com/app/3088/

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Windows logs have a different sourcetype from Linux.
If you install both the Windows and Linux TA on the machines it will put the data into the appropriate sourcetypes for you.

If however you are talking about EC2 cloud trail/cloud watch etc, you will need to look at the data carefully, because when ec2 reports metrics it has no concept of the instance OS.

See the following Apps for more info:
Windows/Linux
https://splunkbase.splunk.com/app/742/
https://splunkbase.splunk.com/app/833/

AWS:
https://splunkbase.splunk.com/app/1876/
https://splunkbase.splunk.com/app/1274/

Azure/GCP:
https://splunkbase.splunk.com/app/3110/
https://splunkbase.splunk.com/app/3088/

If my comment helps, please give it a thumbs up!
0 Karma

N92
Path Finder

Thanks for the clarification about cloudtrail/cloudwatch logs.

In cloudwatch logs suppose I am getting failed login events which same as windows logs (event id 4625). So it should be parsed as a windows parsing?

If yes then it would be done by AWS splunk app?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...