Splunk Enterprise

How does the Universal Forwarder Detects the Source field in a WIndows Event Log?

shocko
Contributor

I'm collecting the System logs from a Windows 2012 R2 DHCP Server using Splunk Universal forwarder 9.0.1.0 to a Splunk Enterprise 8.2.5 indexer. Initially I was collecting all logs using this stanza

 

 

 

[WinEventLog://System]
start_from = oldest
disabled = 0
current_only = 0 

 

 

 

As per the inputs.conf guide here it states that for the allowed key values in an WindowsEvent log monitoring stanza we may use

SourceName The source of the entity that generated the event. Corresponds to Source in Event Viewer.

 

I wished to reduce the number of events collected to only those related to DHCP. When I look into the windows event viewer I see this event for example

shocko_0-1669065720711.png

However, if I search for any event in my indexed data from this server with 

 

 

 

SoureName = DHCP-Server

 

 

 

there are no results. A simple query over all time like this shows this

 

 

 

index=windowsdhcp 
|  stats count by SourceName

 

 

 

Howver, in the putput of the stats of all Sourcenames I see this Sourcename namely Microsoft-Windows-DHCP-Server. So I got back to windows event vierwer and look at the XML view of the event which is as follows:

 

 

 

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" /> 
  <EventID Qualifiers="0">1376</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2022-11-21T17:14:28.000000000Z" /> 
  <EventRecordID>1236733</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>System</Channel> 
  <Computer>vmsys305.vhihealthcare.net</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>10.119.6.0</Data> 
  <Data>89</Data> 
  <Data>6</Data> 
  </EventData>
  </Event>

 

 

 

There is no mention of the event with Source=Microsoft-Windows-DHCP-Server. The Providername is the same howeverI then press the Copy button which yeilds the following pasted data (to notepad):

 

 

 

Log Name:      System
Source:        Microsoft-Windows-DHCP-Server
Date:          21/11/2022 21:13:18
Event ID:      1376
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      vmsys609.vhihealthcare.net
Description:
IP address range of scope 10.119.6.0 is 89 percent full with only 6 IP addresses available.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" />
    <EventID Qualifiers="0">1376</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-11-21T21:13:18.000000000Z" />
    <EventRecordID>93904</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>vmsys609.vhihealthcare.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>10.119.6.0</Data>
    <Data>89</Data>
    <Data>6</Data>
  </EventData>
</Event>

 

 

 

So now we have our SourceName=Source mapping.

Summary

So this leads me to belive that the sttaement from this guide regarding the SourceName being equivelent to the Source as seen in Windows event viewer requires some clarifcaiton namely that it is as viewed from the output of the copy of the xml view of the event not the default output.

 

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...