Getting Data In

Help me find where my sourcetype is getting broken ?

daniel333
Builder

All,

My Windows Event Log items are coming in as sourcetype=WinEventLog and not sourcetype=WinEventLog:Security as it set in my inputs.conf

# inputs.conf
[WinEventLog://Security]
  source = WinEventLog:Security
  sourcetype=WinEventLog:Security
  disabled = 0
  start_from = oldest
  current_only = 0
  evt_resolve_ad_obj = 1
  checkpointInterval = 5
  blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
  blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
  index = wineventlog
  renderXml=false

On my intermediate servers I have a props.conf file

[source::WinEventLog:Security]
  sourcetype=WinEventLog:Security
  TRANSFORMS-winsourceeventlogsecurity = route_stubhinfo_to_es

[WinEventLog:Security]
 TRANSFORMS-wineventlogsecurity = route_stubhinfo_to_es
#props.conf
[route_stubhinfo_to_es]
  REGEX=.*
  DEST_KEY=_TCP_ROUTING
  FORMAT=lvssplunkes

My indexers do not have any props.conf settings.
My search heads do not have search time sourcetype renaming enabled.

Any idea where I might be messing up? How I can troubleshoot this farther?

0 Karma

FrankVl
Ultra Champion

You probably have Splunk TA Windows v5.0.0 installed, this does sourcetype transforms and as of version 5.0.0, sourcetype no longer includes the type of eventlog, it just says "WinEventLog". See also: http://docs.splunk.com/Documentation/WindowsAddOn/5.0.0/User/Upgrade#Source_and_sourcetype_changes_f...

0 Karma

daniel333
Builder

I am not seeing anything that could cause that.

Splunk Add-on for Microsoft Windows version 4.8.4
Copyright (C) 2009-2016 Splunk Inc. All Rights Reserved.

For documentation, see: http://docs.splunk.com/Documentation/WindowsAddOn/latest

0 Karma

FrankVl
Ultra Champion

Are you sure you have 4.8.4 everywhere and not version 5?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...