Knowledge Management

What datamodel is "windows" tag belong

jadengoho
Builder

I always saw these "OS" and "Windows" tags on the eventtypes.conf and tags.conf.
It's on the production environment and splunkbase applications even we're only using default Splunk CIM.
OS- can be part of Performance datamodel, how about windows ? What datamodel does it belongs ?

alt text

Labels (3)
Tags (2)
0 Karma
1 Solution

PavelP
Motivator

Hello @jadengoho

the tag "windows" doesn't belong to the default Splunk CIM and can be set by Splunk Add-on for Microsoft Windows, here is an excerpt from default/tags.conf:

###### Global Windows Eventtype ######

[eventtype=fs_notification]
endpoint = enabled
change = enabled

[eventtype=wineventlog_windows]
os = enabled
windows = enabled

[eventtype=wineventlog_application]
os = enabled
windows = enabled

[eventtype=wineventlog_system]
os = enabled
windows = enabled

[eventtype=wineventlog_security]
os = enabled
windows = enabled

[eventtype=perfmon_windows]
os = enabled
windows = enabled

[eventtype=perfmon_processorinformation]
process = enabled
report = enabled
performance = enabled
cpu = enabled

[eventtype=hostmon_windows]
os = enabled
windows = enabled

[eventtype=hostmon_os]
os = enabled
windows = enabled
memory = enabled
performance = enabled
oshost = enabled

you can run btool command to find out which add-on sets this tag:

splunk btool tags list --debug

View solution in original post

0 Karma

PavelP
Motivator

Hello @jadengoho

the tag "windows" doesn't belong to the default Splunk CIM and can be set by Splunk Add-on for Microsoft Windows, here is an excerpt from default/tags.conf:

###### Global Windows Eventtype ######

[eventtype=fs_notification]
endpoint = enabled
change = enabled

[eventtype=wineventlog_windows]
os = enabled
windows = enabled

[eventtype=wineventlog_application]
os = enabled
windows = enabled

[eventtype=wineventlog_system]
os = enabled
windows = enabled

[eventtype=wineventlog_security]
os = enabled
windows = enabled

[eventtype=perfmon_windows]
os = enabled
windows = enabled

[eventtype=perfmon_processorinformation]
process = enabled
report = enabled
performance = enabled
cpu = enabled

[eventtype=hostmon_windows]
os = enabled
windows = enabled

[eventtype=hostmon_os]
os = enabled
windows = enabled
memory = enabled
performance = enabled
oshost = enabled

you can run btool command to find out which add-on sets this tag:

splunk btool tags list --debug
0 Karma

jadengoho
Builder

Hi @PavelP what's the purpose of this tag if it doesn't belong to any datamodel ?

0 Karma

PavelP
Motivator

@jadengoho
tags are not exclusive for data models and used generally to assign names to specific field and value combinations, so if you search for tag=windows or tag::windows you get windows-related (coming from) events.

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Abouttagsandaliases

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...