Splunk Search

What is the reseasoning behind the Sysmon sourcetype?

daniel333
Builder

all,

I was just looking at the sysmon sourcetype "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" and it's not really intuitive. What's the reasoning behind this naming convention?

0 Karma
1 Solution

dstaulcu
Builder

the xmlWinEventLog token is important as part of a metadata field because its presence influences search or index time field extractions specific to xml structured event logs

the source and sourcetype values are identical coming off universal forwarders. with splunk app for windows v5, the index time field extractions were configured to drop the logname token from the sourcetype field. i trust that splunk has big plans that will make this breaking change worthwhile but i am not aware of what those plans are and im sure those plans are stifled in implementation because knowledge object dependency management (adapting to the breaking change) is extremely cumbersome, particularly in a clustered search head scenario.

the /operation token is not influenced by splunk. the varying values in that position represent the class of events the registered event source is associated with..it's a windows thing... values could be be admin|operational|debug|analytic

View solution in original post

0 Karma

dstaulcu
Builder

the xmlWinEventLog token is important as part of a metadata field because its presence influences search or index time field extractions specific to xml structured event logs

the source and sourcetype values are identical coming off universal forwarders. with splunk app for windows v5, the index time field extractions were configured to drop the logname token from the sourcetype field. i trust that splunk has big plans that will make this breaking change worthwhile but i am not aware of what those plans are and im sure those plans are stifled in implementation because knowledge object dependency management (adapting to the breaking change) is extremely cumbersome, particularly in a clustered search head scenario.

the /operation token is not influenced by splunk. the varying values in that position represent the class of events the registered event source is associated with..it's a windows thing... values could be be admin|operational|debug|analytic

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...