Splunk Search

Windows TA field extractions are not working

iainsmart
Engager

Hi,

When I search for Windows Event Logs using :
index=oswin sourcetype=XmlWinEventLog

I'm not getting any parsing/syntax highlighting or field extractions happening. The results are simply the raw XML. I have checked that I am in List format!

If I search for other indexes and sourcetypes I am getting correct parsing/syntax highlighting and extractions.

How can I go about finding out why this is happening and fix it?

Thanks,

Iain

0 Karma

irievibe
Explorer

I have the same problem and have TA everywhere and using verbose mode

The windows event viewer shows

...."Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
SYNCHRONIZE
ReadAttributes

Access Reasons: DELETE: Granted by D:(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)"

But in Splunk all I see is:

<Data Name='AccessList'>%%1537 %%1541 %%4423 </Data><Data Name='AccessReason'>%%1537: %%1801 😧(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)

 

I have many fields being parsed, but I don't even see "Accesss" in the raw data. It seems this is not being parsed correctly but also, Splunk isn't even able to read the data from Windows correctly to include Accesses: DELETE in the raw data

0 Karma

irievibe
Explorer

I found that the Windows_TA app had the Security stanza disabled on my indexer. I had it set for forwarder and search head, but the indexer was misconfigured.
EventCode=4656 Accessed=DELETE works for me now

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Make sure you are in Verbose mode and that the Windows TA is installed on your search head.

---
If this reply helps you, Karma would be appreciated.
0 Karma

iainsmart
Engager

I am in Verbose mode and the TA is installed on the search head

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...