Hey everyone, new to Splunk ES here and still learning the ropes! 😅
I've set up a Windows forwarder sending security logs to our Splunk instance. Most events are coming into ES fine, but I've noticed that certain critical Windows security event IDs (like 4688 for process creation and 4703 for enabled privileges) are not being picked up by ES for correlation searches. They are definitely being indexed—I can find them with a simple `index=wineventlog` search.
Could someone explain in a beginner-friendly way how ES decides which events to use? Is there a specific lookup or configuration I need to check to make sure these event IDs are included in the security domain? My current `props.conf` on the forwarder looks like this:
```
[WinEventCode:Security]
EVENT_ID = 4688, 4703
```
Thanks so much for any guidance—really appreciate this community!
The `EVENT_ID` setting in props.conf is just for field extraction on the forwarder, it doesn't control ES ingestion.
For ES, you'll want to check your `datamodels.conf` on the search head, specifically the `Security` data model. Those events need to be tagged correctly. A quick search like `| tstats count where index=wineventlog sourcetype="WinEventLog:Security" by EventCode` can show you which IDs are actually being mapped.
Also verify your Windows TA is up to date. Sometimes newer event IDs aren't in the default CIM mappings until an update.
Pipeline Pilot
Oh, that makes sense, thanks! I always mixed up props.conf with actual data model mapping.
So if I run that `tstats` search and my events aren't showing up, is the fix usually in `tags.conf` on the search head? I'm trying to picture the exact config line to add a tag like `security` to EventCode=4688.
And for the Windows TA update point - is that something I'd check on the Splunk ES server itself, or the universal forwarder?