Splunk Search

How to extract fields for WinEventLog Fields when Exported as a CSV?


I am trying not to reinvent the wheel. There is a requirement where WinEventLogs are indexed as csv files. The sourcetype is automatically detected as structured data and set to csv. I have tried to look through the Splunk_TA_Windows to see if there were any field extraction config that I could modify slightly to get the field extractions to work. So far I have been unsuccessful. The issue is that the normal message of the log is showing as EXTRA_FIELD_6. I could create a bunch of manual field extractions for Account Name, Account Domain, etc, but it would be great if I could leverage someone else's heavy lifting.

Any thoughts would be appreciated.


0 Karma


Yes, by default with csv as sourcetype for window event logs - it will extract _time, date and time, event_id, extracted_source, level, task category and the EXTRA_FIELDS_6 - if you still need the EXTRA_FIELD_6 to be parsed and properly extract the fields you need to field-extraction using regex (OR) delimiters.

try this link, you ll have some idea,

0 Karma


Thank you. I don't have an issue with getting the wineventlog into csv. And yes I need to extract the fields that are now within "EXTRA_FIELD_6". I was hoping to leverage the Splunk_TA_Windows and make a few tweaks, so I would not have to do all of the extractions manually.

0 Karma
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...