Utilizing Splunk_TA_windows 5.0.1, on Splunk 7.1.2 - I have applocker event log inputs defined (with renderXml = true) on various hosts running the Universal Forwarder, with no sourcetype set in the inputs.conf. The issue is that the TA is not properly setting the expected source for an XmlWinEventLog* sourcetyped event. They remain as they were before the TA upgrade - which is "WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" instead of the expected "XmlWinEventLog:Microsoft-Windows-AppLocker/EXE and DLL". It gets more confusing because the TA renames sourcetypes at search time with a props "rename" option, but I was able to verify the sourcetype is indexed correctly by searching using _sourcetype instead and getting the expected results. On our heavy forwarder, I dug into the TA and found a couple wildcard stanzas that apply transforms which are supposed to change the source and sourcetype: default\props.conf [(?::){0}WinEventLog:*] TRANSFORMS-Fixup = ta-windows-fix-classic-source,ta-windows-fix-sourcetype [(?::){0}XmlWinEventLog:*] TRANSFORMS-XmlFixup = ta-windows-fix-xml-source,ta-windows-fix-sourcetype default\transforms.conf [ta-windows-fix-classic-source] DEST_KEY = MetaData:Source REGEX = (?m)^LogName=(.+?)\s*$ FORMAT = source::WinEventLog:$1 [ta-windows-fix-xml-source] DEST_KEY = MetaData:Source REGEX = <Channel>(.+?)<\/Channel>.* FORMAT = source::XmlWinEventLog:$1 [ta-windows-fix-sourcetype] SOURCE_KEY = MetaData:Sourcetype DEST_KEY = MetaData:Sourcetype REGEX = sourcetype::([^:]*) FORMAT = sourcetype::$1 However, these don't seem to be matching events properly, in this specific example, an event sourcetyped "XmlWinEventLog:Microsoft-Windows-AppLocker/EXE and DLL". To test, I added the following stanza in the windows TA local\props.conf on the HF and restarted it: [XmlWinEventLog:Microsoft-Windows-AppLocker/EXE and DLL] TRANSFORMS-XmlFixup = ta-windows-fix-xml-source,ta-windows-fix-sourcetype And I get the expected results - the transforms now apply to that sourcetype, and the correct source of "XmlWinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" is now indexed. Is this a bug in the TA or my version of Splunk with the "undocumented" sourcetype stanza wildcard method, or have I got something misconfigured? ... View more

I have a simple powershell input: [powershell://Windows:Applications] script = Get-WmiObject -Class Win32_Product | Select-Object -Property Name,InstallDate,Version,InstallLocation,Description interval=86400 disabled=0 index=winclientlogs sourcetype=installed_apps We deploy this input inside the Splunk_TA_Windows app to our Windows workstations - roughly 1800+ of them, a mix of Windows 7 and Windows 10. This input works flawlessly to report installed applications across all the workstations (after setting reasonable powershell execution policy via GPO, of course). However, roughly 8 Windows 10 hosts (which are a mix of 15063 and 16299), all running the 7.0 forwarder, seem to be executing this powershell input differently. We log Powershell event logs from WinEventLog:Microsoft-Windows-PowerShell/Operational , and had not yet filtered out Splunk Powershell events - I was doing some basic review of these event logs when I noticed a higher sustained volume EventCode 4103 from a handful of hosts, which led to the discovery that the forwarder on these 8 hosts appears to be running powershell pipeline executions *roughly 900 times a minute. * The events differ from the "normal/expected" operation because in the Powershell event logs, they invoke the "Out-Null" method, followed by a "Sleep-Start" method (for 200ms). On every other host not exhibiting this behavior, the forwarder executes with the "Add-Type" method. Regardless of this difference, the problematic hosts still execute the powershell - they just create a TON more noise doing it... I'm curious if this is a bug in the forwarder, or some possible difference in the powershell environment for these hosts. Things I've done to troubleshoot: - Reinstalled forwarders (no change) - Upgraded forwarders to 7.0.3 (no change) - tried using schedule instead of interval directive in the input (no change) For example - problematic host has 4103 for splunk-powershell.exe that starts with: CommandInvocation(Out-Null): "Out-Null" These are followed by a nearly identical 4103, except with: CommandInvocation(Start-Sleep): "Start-Sleep" ParameterBinding(Start-Sleep): name="Milliseconds"; value="200" Where a host not exhibiting the 900 events a minute starts like this: CommandInvocation(Add-Type): "Add-Type" ParameterBinding(Add-Type): name="MemberDefinition"; value="[DllImport("kernel32.dll")] public static extern bool SetEvent(IntPtr handle);" ParameterBinding(Add-Type): name="Name"; value="Win32Utils" ParameterBinding(Add-Type): name="Namespace"; value="SetEvent" ParameterBinding(Add-Type): name="PassThru"; value="True" Hoping someone has some ideas as I'd like to address this instead of just drop the noise at our heavy forwarder.. ... View more