topic Re: Vmware workspace one (mobile device management (MDM)) in Getting Data In

Vmware workspace one (mobile device management (MDM))

hazem — Mon, 21 Oct 2024 11:51:45 GMT

our Splunk received logs from Vmware workspace one (mobile device management (MDM)) as syslog messages.

what is the source type needed to be configured in inputs.conf or is there any addon to assist In parsing?

Re: Vmware workspace one (mobile device management (MDM))

gcusello — Mon, 21 Oct 2024 19:02:29 GMT

if you're using the Add-on for WorkspaceOne, you should search the default sourcetype in props.conf, that should be taworkspaceone:log.

Ciao.

Giuseppe

Re: Vmware workspace one (mobile device management (MDM))

hazem — Tue, 22 Oct 2024 10:08:19 GMT

Hi @gcusello

i noticed that Splunk does not support the Add-on for WorkspaceOne.and has no documentation.

is there any supported app to parse the Vmware workspace one-MDM

Re: Vmware workspace one (mobile device management (MDM))

gcusello — Tue, 22 Oct 2024 15:39:38 GMT

Hi @hazem ,

this is the only app for that technology in Splunkbase,

I understand that it isn't supported neither by Splunk and another developer, but this is the only alternative solution than create your own custom add-on, so I hint to use it, eventually customizing it and supporting by yourself.

Ciao.

Giuseppe