Splunk Search

Define user field in Security Essentials

samhodgson
Path Finder

I have added Security Essentials on my indexer and the Splunk_TA_windows app on the forwarders however when i run the First Time Logon to New Server query I get

'You should have a field called "user" defined in your Windows Security logs. This is provided by the Splunk TA for Windows. Consider adding that TA to make for a better experience!'

How do I define fields? Does this add-on change the user_logon field from the security event log to user for cim or something?

nickhills
Ultra Champion

You actually need to have the "Splunk Add-on for Microsoft Windows" installed on your Searcheads/Indexers.
https://splunkbase.splunk.com/app/742/
This will configure all of the necessary field extractions in order to allow those searches to run, and as you have noted formats the data inline with the Splunk Common Information Model

When you install the TA on an indexer/SH you don't need to configure anything, simply install and restart when prompted.

Sidenote: Best practices says that ideally you remove the inputs.conf/eventgen.conf/sample data when installing to Production, but not strictly necessary.

If my comment helps, please give it a thumbs up!
0 Karma

tnorth42
Explorer

You need to setup the inputs.conf for the Splunk_TA_windows app.

https://docs.splunk.com/Documentation/WindowsAddOn/4.8.4/User/Configuration

0 Karma

pil321
Communicator

tnorth42 - I have inputs.conf set up. Which specific stanza in the inputs.conf file needs to be enabled?

luis290311
Explorer

Same problem for me. Apparently the user field is not extracted correctly in Splunk 7.03 when the AD server OS is in a foreign laguage, in my casi spanish

0 Karma

tnorth42
Explorer

Unfortunately I am not sure exactly which one does it, i do know that after enabling all it was showing up. can you tag this with "Splunk Security Essentials", the developer usually replies back very quickly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...