Splunk Search

What is the reseasoning behind the Sysmon sourcetype?

daniel333
Builder

all,

I was just looking at the sysmon sourcetype "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" and it's not really intuitive. What's the reasoning behind this naming convention?

0 Karma
1 Solution

dstaulcu
Builder

the xmlWinEventLog token is important as part of a metadata field because its presence influences search or index time field extractions specific to xml structured event logs

the source and sourcetype values are identical coming off universal forwarders. with splunk app for windows v5, the index time field extractions were configured to drop the logname token from the sourcetype field. i trust that splunk has big plans that will make this breaking change worthwhile but i am not aware of what those plans are and im sure those plans are stifled in implementation because knowledge object dependency management (adapting to the breaking change) is extremely cumbersome, particularly in a clustered search head scenario.

the /operation token is not influenced by splunk. the varying values in that position represent the class of events the registered event source is associated with..it's a windows thing... values could be be admin|operational|debug|analytic

View solution in original post

0 Karma

dstaulcu
Builder

the xmlWinEventLog token is important as part of a metadata field because its presence influences search or index time field extractions specific to xml structured event logs

the source and sourcetype values are identical coming off universal forwarders. with splunk app for windows v5, the index time field extractions were configured to drop the logname token from the sourcetype field. i trust that splunk has big plans that will make this breaking change worthwhile but i am not aware of what those plans are and im sure those plans are stifled in implementation because knowledge object dependency management (adapting to the breaking change) is extremely cumbersome, particularly in a clustered search head scenario.

the /operation token is not influenced by splunk. the varying values in that position represent the class of events the registered event source is associated with..it's a windows thing... values could be be admin|operational|debug|analytic

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!