https://community.splunk.com/t5/Splunk-Enterprise/Linux-Auditd-and-Linux-Auditd-Technology-Add-On-App-Installation/m-p/678443#M18746 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Symon_0-1708668015409.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29457i97992704B9A4296D/image-size/medium?v=v2&amp;px=400" role="button" title="Symon_0-1708668015409.png" alt="Symon_0-1708668015409.png" /></span></P><P>I downloaded and installed these apps from Splunkbase.<BR /><BR /><A href="https://splunkbase.splunk.com/app/4232" target="_blank">https://splunkbase.splunk.com/app/4232</A><BR /><A href="https://splunkbase.splunk.com/app/2642" target="_blank">https://splunkbase.splunk.com/app/2642</A><BR /><BR />As per the instructions, I added the<BR /><SPAN>sourcetype=linux_audit to the local <STRONG>"auditd_events" eventtype in TA</STRONG><BR />and<BR />linux_audit&nbsp;to list of <STRONG>sourcetypes in TA-linux_auditd/lookups/auditd_sourcetypes.csv<BR /></STRONG><BR />but the dashboard data is not showing up.<BR />My existing auditd events belong to the different sourcetype names and eventtype names.&nbsp;<BR /><BR />For example,&nbsp;<BR />I got the auditd events.<BR /><EM>index="<STRONG>linux_fw</STRONG>" sourcetype="<STRONG>syslog</STRONG>" eventtype="<STRONG>mycustom_audit_events</STRONG>"</EM><BR /><BR />Therefore,&nbsp;<BR />Do I need to<BR />add the&nbsp;sourcetype="<STRONG>syslog</STRONG>" to the local <STRONG>"auditd_events" eventtype in TA</STRONG><BR />and<BR />add the <STRONG>syslog</STRONG> to list of <STRONG>sourcetypes in TA-linux_auditd/lookups/auditd_sourcetypes.csv ??</STRONG><BR /></SPAN></P> Fri, 23 Feb 2024 09:30:43 GMT Symon 2024-02-23T09:30:43Z https://community.splunk.com/t5/Splunk-Enterprise/Linux-Auditd-and-Linux-Auditd-Technology-Add-On-App-Installation/m-p/678443#M18746 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Symon_0-1708668015409.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29457i97992704B9A4296D/image-size/medium?v=v2&amp;px=400" role="button" title="Symon_0-1708668015409.png" alt="Symon_0-1708668015409.png" /></span></P><P>I downloaded and installed these apps from Splunkbase.<BR /><BR /><A href="https://splunkbase.splunk.com/app/4232" target="_blank">https://splunkbase.splunk.com/app/4232</A><BR /><A href="https://splunkbase.splunk.com/app/2642" target="_blank">https://splunkbase.splunk.com/app/2642</A><BR /><BR />As per the instructions, I added the<BR /><SPAN>sourcetype=linux_audit to the local <STRONG>"auditd_events" eventtype in TA</STRONG><BR />and<BR />linux_audit&nbsp;to list of <STRONG>sourcetypes in TA-linux_auditd/lookups/auditd_sourcetypes.csv<BR /></STRONG><BR />but the dashboard data is not showing up.<BR />My existing auditd events belong to the different sourcetype names and eventtype names.&nbsp;<BR /><BR />For example,&nbsp;<BR />I got the auditd events.<BR /><EM>index="<STRONG>linux_fw</STRONG>" sourcetype="<STRONG>syslog</STRONG>" eventtype="<STRONG>mycustom_audit_events</STRONG>"</EM><BR /><BR />Therefore,&nbsp;<BR />Do I need to<BR />add the&nbsp;sourcetype="<STRONG>syslog</STRONG>" to the local <STRONG>"auditd_events" eventtype in TA</STRONG><BR />and<BR />add the <STRONG>syslog</STRONG> to list of <STRONG>sourcetypes in TA-linux_auditd/lookups/auditd_sourcetypes.csv ??</STRONG><BR /></SPAN></P> Fri, 23 Feb 2024 09:30:43 GMT https://community.splunk.com/t5/Splunk-Enterprise/Linux-Auditd-and-Linux-Auditd-Technology-Add-On-App-Installation/m-p/678443#M18746 Symon 2024-02-23T09:30:43Z