Splunk Enterprise

How does the Universal Forwarder Detects the Source field in a WIndows Event Log?

shocko
Contributor

I'm collecting the System logs from a Windows 2012 R2 DHCP Server using Splunk Universal forwarder 9.0.1.0 to a Splunk Enterprise 8.2.5 indexer. Initially I was collecting all logs using this stanza

 

 

 

[WinEventLog://System]
start_from = oldest
disabled = 0
current_only = 0 

 

 

 

As per the inputs.conf guide here it states that for the allowed key values in an WindowsEvent log monitoring stanza we may use

SourceName The source of the entity that generated the event. Corresponds to Source in Event Viewer.

 

I wished to reduce the number of events collected to only those related to DHCP. When I look into the windows event viewer I see this event for example

shocko_0-1669065720711.png

However, if I search for any event in my indexed data from this server with 

 

 

 

SoureName = DHCP-Server

 

 

 

there are no results. A simple query over all time like this shows this

 

 

 

index=windowsdhcp 
|  stats count by SourceName

 

 

 

Howver, in the putput of the stats of all Sourcenames I see this Sourcename namely Microsoft-Windows-DHCP-Server. So I got back to windows event vierwer and look at the XML view of the event which is as follows:

 

 

 

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" /> 
  <EventID Qualifiers="0">1376</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2022-11-21T17:14:28.000000000Z" /> 
  <EventRecordID>1236733</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>System</Channel> 
  <Computer>vmsys305.vhihealthcare.net</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>10.119.6.0</Data> 
  <Data>89</Data> 
  <Data>6</Data> 
  </EventData>
  </Event>

 

 

 

There is no mention of the event with Source=Microsoft-Windows-DHCP-Server. The Providername is the same howeverI then press the Copy button which yeilds the following pasted data (to notepad):

 

 

 

Log Name:      System
Source:        Microsoft-Windows-DHCP-Server
Date:          21/11/2022 21:13:18
Event ID:      1376
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      vmsys609.vhihealthcare.net
Description:
IP address range of scope 10.119.6.0 is 89 percent full with only 6 IP addresses available.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" />
    <EventID Qualifiers="0">1376</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-11-21T21:13:18.000000000Z" />
    <EventRecordID>93904</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>vmsys609.vhihealthcare.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>10.119.6.0</Data>
    <Data>89</Data>
    <Data>6</Data>
  </EventData>
</Event>

 

 

 

So now we have our SourceName=Source mapping.

Summary

So this leads me to belive that the sttaement from this guide regarding the SourceName being equivelent to the Source as seen in Windows event viewer requires some clarifcaiton namely that it is as viewed from the output of the copy of the xml view of the event not the default output.

 

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...