Splunk Search

How to extract fields for WinEventLog Fields when Exported as a CSV?


I am trying not to reinvent the wheel. There is a requirement where WinEventLogs are indexed as csv files. The sourcetype is automatically detected as structured data and set to csv. I have tried to look through the Splunk_TA_Windows to see if there were any field extraction config that I could modify slightly to get the field extractions to work. So far I have been unsuccessful. The issue is that the normal message of the log is showing as EXTRA_FIELD_6. I could create a bunch of manual field extractions for Account Name, Account Domain, etc, but it would be great if I could leverage someone else's heavy lifting.

Any thoughts would be appreciated.


0 Karma


Yes, by default with csv as sourcetype for window event logs - it will extract _time, date and time, event_id, extracted_source, level, task category and the EXTRA_FIELDS_6 - if you still need the EXTRA_FIELD_6 to be parsed and properly extract the fields you need to field-extraction using regex (OR) delimiters.

try this link, you ll have some idea,

0 Karma


Thank you. I don't have an issue with getting the wineventlog into csv. And yes I need to extract the fields that are now within "EXTRA_FIELD_6". I was hoping to leverage the Splunk_TA_Windows and make a few tweaks, so I would not have to do all of the extractions manually.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...