topic Looking for solutions for Linux/Unix Auditing? in Getting Data In

Looking for solutions for Linux/Unix Auditing?

kymenope — Wed, 15 Mar 2023 16:24:30 GMT

Fairly new Splunk user here looking for Linux auditing solutions. I am running a disconnected version of Splunk Enterprise and thus cannot make use of the content pack which replaced the application and add-on according to SplunkBase.

Am I still able to use the archived applications and add-on?

Realistically I am seeking a solution that would allow me to configure the universal forwarders I'm using to send the appropriate data so I can create queries via the linux_secure sourcetype.

Re: Looking for solutions for Linux/Unix Auditing

isoutamo — Tue, 14 Mar 2023 21:00:20 GMT

I'm not sure if I understood right your question.

There is no need to be a connection between your instance and splunkbase. Just download those apps/TAs etc from it to your workstation and then transfer those with any usable way to your UF's, DS and/or Splunk enterprise instances. Then just install those as instructions said and start to use those.

That's the way how I do installation almost every time. I use that direct connection to splunkbase only on my test/demo etc. instances, never on production systems.

r. Ismo