topic Re: How can I index security logs from Bomgar? in Getting Data In

How can I index security logs from Bomgar?

Rocky31 — Thu, 30 Nov 2017 23:06:12 GMT

I have to onboard Bomgar data to Splunk these are some kind of security logs. I haven't seen any related question and answers here.

First, I have to on board, what is the best practice for the first time onboarding logs.
Any suggestions folks, I haven't found any Apps or TA's for this one.

Thanks in advance

Re: How can I index security logs from Bomgar?

woodcock — Fri, 01 Dec 2017 15:39:00 GMT

Make sure you set the "big 6" settings and get them right:

TIME_PREFIX=YourPrefixHere
SHOULD_LINEMERGE=false
LINE_BREAKER=YourRegExHere
MAX_TIMESTAMP_LOOKAHEAD=YourOffsetHere
TIME_FORMAT=YourFormatHere
TRUNCATE=9999999

If you don't find an app, you can ask around the community (join slack and hit #general)

Re: How can I index security logs from Bomgar?

spayneort — Fri, 01 Dec 2017 15:50:47 GMT

It looks like Bomgar has an integration: https://www.bomgar.com/docs/remote-support/how-to/integrations/splunk/index.htm

There is also this: https://github.com/guilhemmarchand/bomgar-for-splunk

Re: How can I index security logs from Bomgar?

Rocky31 — Fri, 01 Dec 2017 22:19:52 GMT

How to join in slack, do I need to sign up?
can you share the link with me, please?

Re: How can I index security logs from Bomgar?

woodcock — Sat, 02 Dec 2017 21:09:25 GMT

https://answers.splunk.com/answers/443734/is-there-a-splunk-slack-channel.html

Re: How can I index security logs from Bomgar?

Rocky31 — Wed, 06 Dec 2017 05:42:35 GMT

Is it this app is paid or free?