Splunk Search

What is the reseasoning behind the Sysmon sourcetype?

daniel333
Builder

all,

I was just looking at the sysmon sourcetype "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" and it's not really intuitive. What's the reasoning behind this naming convention?

0 Karma
1 Solution

dstaulcu
Builder

the xmlWinEventLog token is important as part of a metadata field because its presence influences search or index time field extractions specific to xml structured event logs

the source and sourcetype values are identical coming off universal forwarders. with splunk app for windows v5, the index time field extractions were configured to drop the logname token from the sourcetype field. i trust that splunk has big plans that will make this breaking change worthwhile but i am not aware of what those plans are and im sure those plans are stifled in implementation because knowledge object dependency management (adapting to the breaking change) is extremely cumbersome, particularly in a clustered search head scenario.

the /operation token is not influenced by splunk. the varying values in that position represent the class of events the registered event source is associated with..it's a windows thing... values could be be admin|operational|debug|analytic

View solution in original post

0 Karma

dstaulcu
Builder

the xmlWinEventLog token is important as part of a metadata field because its presence influences search or index time field extractions specific to xml structured event logs

the source and sourcetype values are identical coming off universal forwarders. with splunk app for windows v5, the index time field extractions were configured to drop the logname token from the sourcetype field. i trust that splunk has big plans that will make this breaking change worthwhile but i am not aware of what those plans are and im sure those plans are stifled in implementation because knowledge object dependency management (adapting to the breaking change) is extremely cumbersome, particularly in a clustered search head scenario.

the /operation token is not influenced by splunk. the varying values in that position represent the class of events the registered event source is associated with..it's a windows thing... values could be be admin|operational|debug|analytic

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...