Splunk Search

How to configure Splunk to extract XML fields from Windows security event 4698?

Path Finder

We are currently forwarding Windows security event 4698 to Splunk, and would like to be able to parse/extract a number of the XML fields. Is there a way that Splunk can be configured to do this, or will we need to create custom field extractions for the XML fields that we are interested in?

Thank you.

0 Karma

Path Finder

Hi adamblcok2,

You can use xmlkv command to extract the fields based on XML tag.

index=wineventlog EventCode=4698 | xmlkv

or in props.conf

you can add the the below attribute under your sourcetype stanza.

KV_MODE=xml

-Krishna Rajapantula

Champion

Just messing around in my environment it looks like you can rex out the xml to another field and then use spath to find specific data in there. For example, this will put the xml for the task in a field called taskxml. Then pipe to spath and looking at that new field, grab the Action execution settings (putting it in a new field called actioncommand)

index=wineventlog EventCode=4698 | rex "(?i)(?<task_xml>\<task[\s\S]+\<\/task\>)" | spath input=task_xml output=action_command path=Task.Actions.Exec.Command
0 Karma