API tools faq
paste
phoenixdigital

Windows DHCP Splunk sourcetype rename

phoenixdigital
Jun 24th, 2015
777
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.86 KB | None | 0 0
raw download clone embed print report
  1. default/eventtypes.conf
  2. -----------------------
  3.  
  4. ###### DHCP ######
  5. [msdhcp]
  6. search = sourcetype=msdhcp
  7. #tags = dhcp network session windows
  8.  
  9. [msdhcp_start]
  10. search = sourcetype=msdhcp (msdhcp_id=10 OR msdhcp_id=11 OR msdhcp_id=13)
  11. #tags = start
  12.  
  13. [msdhcp_end]
  14. search = sourcetype=msdhcp (msdhcp_id=12 OR msdhcp_id=16 OR msdhcp_id=17)
  15. #tags = end
  16.  
  17. [DhcpSrvLog]
  18. search = sourcetype=DhcpSrvLog
  19. #tags = dhcp network session windows
  20.  
  21. [DhcpSrvLog_start]
  22. search = sourcetype=DhcpSrvLog (msdhcp_id=10 OR msdhcp_id=11 OR msdhcp_id=13)
  23. #tags = start
  24.  
  25. [DhcpSrvLog_end]
  26. search = sourcetype=DhcpSrvLog (msdhcp_id=12 OR msdhcp_id=16 OR msdhcp_id=17)
  27. #tags = end
  28.  
  29.  
  30.  
  31. -----------------------
  32. default/props.conf
  33. -----------------------
  34. ###########################
  35. ## DHCP
  36. ###########################
  37. [source::....DhcpSrvLog]
  38. sourcetype = DhcpSrvLog
  39.  
  40. [source::...\\(DhcpSrvLog-)...]
  41. sourcetype = DhcpSrvLog
  42.  
  43. [DhcpSrvLog]
  44. SHOULD_LINEMERGE = false
  45. REPORT-0auto_kv_for_microsoft_dhcp = auto_kv_for_microsoft_dhcp
  46. REPORT-dest_for_microsoft_dhcp = dest_nt_host_as_dest,dest_mac_as_dest,dest_ip_as_dest
  47. LOOKUP-signature_for_microsoft_dhcp = msdhcp_signature_lookup msdhcp_id OUTPUTNEW signature
  48. LOOKUP-vendor_info_for_microsoft_dhcp = windows_vendor_info_lookup sourcetype OUTPUT vendor,product
  49.  
  50. -----------------------
  51. default/transforms.conf
  52. -----------------------
  53.  
  54. ###### DHCP ######
  55. [auto_kv_for_microsoft_dhcp]
  56. DELIMS = ","
  57. FIELDS = msdhcp_id,date,time,description,dest_ip,dest_nt_host,dest_mac
  58.  
  59. [dest_nt_host_as_dest]
  60. SOURCE_KEY = dest_nt_host
  61. REGEX = (.+)
  62. FORMAT = dest::"$1"
  63.  
  64. [dest_mac_as_dest]
  65. SOURCE_KEY = dest_mac
  66. REGEX = (.+)
  67. FORMAT = dest::"$1"
  68.  
  69. [dest_ip_as_dest]
  70. SOURCE_KEY = dest_ip
  71. REGEX = (.+)
  72. FORMAT = dest::"$1"
  73.  
  74. [msdhcp_signature_lookup]
  75. filename = msdhcp_signatures.csv
  76.  
  77.  
  78. -----------------------
  79. local/eventtypes.conf
  80. -----------------------
  81.  
  82. ###### DHCP ######
  83. [DhcpSrvLog]
  84. search = sourcetype=network:dhcp
  85. #tags = dhcp network session windows
  86.  
  87. [DhcpSrvLog_start]
  88. search = sourcetype=network:dhcp (msdhcp_id=10 OR msdhcp_id=11 OR msdhcp_id=13)
  89. #tags = start
  90.  
  91. [DhcpSrvLog_end]
  92. search = sourcetype=network:dhcp (msdhcp_id=12 OR msdhcp_id=16 OR msdhcp_id=17)
  93. #tags = end
  94.  
  95. -----------------------
  96. local/props.conf
  97. -----------------------
  98. ###########################
  99. ## DHCP
  100. ###########################
  101. [source::....DhcpSrvLog]
  102. sourcetype = network:dhcp
  103.  
  104. [source::...\\(DhcpSrvLog-)...]
  105. sourcetype = network:dhcp
  106.  
  107. [network:dhcp]
  108. SHOULD_LINEMERGE = false
  109. REPORT-0auto_kv_for_microsoft_dhcp = auto_kv_for_microsoft_dhcp
  110. REPORT-dest_for_microsoft_dhcp = dest_nt_host_as_dest,dest_mac_as_dest,dest_ip_as_dest
  111. LOOKUP-signature_for_microsoft_dhcp = msdhcp_signature_lookup msdhcp_id OUTPUTNEW signature
  112. LOOKUP-vendor_info_for_microsoft_dhcp = windows_vendor_info_lookup sourcetype OUTPUT vendor,product
  113. -----------------------
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!