Splunk Search

Add original host to windows security event syslog header

agarrison
Path Finder

I want to export windows security events to syslog.
The following works but it shows the events all originate from splunk.
I want to replace the syslog header with the original host or at least tag the original host on the event.

Props.conf
[WinEventLog:Security]
TRANSFORMS-routing = ms_strm_dev

Outputs.conf
[syslog:ms_strm_dev]
server = 10.4.4.200:12468
type=tcp

Transforms.conf
[win_strm]
REGEX = (?msi)Security
DEST_KEY = _SYSLOG_ROUTING
FORMAT = ms_strm_dev

It looks like I could add something like this to my transforms, but how would I format the transform twice?
DEST_KEY = MetaData:Host
REGEX = (.+)
FORMAT = host::$1

0 Karma

sbbadri
Motivator
0 Karma

agarrison
Path Finder

I want to be about to filter AND route, this shows how to do either, but doesn't look like both to the same data. Unless I can route it to one transform, then back through another once it goes through the first.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...