Files
DetectionLab/Vagrant/resources/splunk_server/props.conf
2019-02-18 21:47:03 -08:00

15 lines
364 B
Plaintext

[source::WinEventLog:*]
TRANSFORMS-host = wef_computername_as_host
[powershell_transcript]
TRANSFORMS-powershell_rename_host = powershell_rename_host
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)THISDOESNTEXIST
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIME_FORMAT = %Y%m%d%H%M%S
TIME_PREFIX = Start time:\s
category = Custom
pulldown_type = true
TRUNCATE = 0