How to configure Splunk to extract XML fields from Windows security event 4698?

[adamblock2]

We are currently forwarding Windows security event 4698 to Splunk, and would like to be able to parse/extract a number of the XML fields. Is there a way that Splunk can be configured to do this, or will we need to create custom field extractions for the XML fields that we are interested in?

Thank you.

[krishnarajapant]

Hi adamblcok2,

You can use xmlkv command to extract the fields based on XML tag.

index=wineventlog EventCode=4698 | xmlkv

or in props.conf

you can add the the below attribute under your sourcetype stanza.

KV_MODE=xml

-Krishna Rajapantula

[maciep]

Just messing around in my environment it looks like you can rex out the xml to another field and then use spath to find specific data in there. For example, this will put the xml for the task in a field called task_xml. Then pipe to spath and looking at that new field, grab the Action execution settings (putting it in a new field called action_command)

index=wineventlog EventCode=4698 | rex "(?i)(?<task_xml>\<task[\s\S]+\<\/task\>)" | spath input=task_xml output=action_command path=Task.Actions.Exec.Command