https://community.splunk.com/t5/Monitoring-Splunk/How-to-set-up-configuration-in-SPlunk-for-Tanium/m-p/392970#M6220 <P>I installed Splunk Tanium app in my environment, Can you please help me for the configuration in Splunk for tanium</P> <P>In which configuration file i need to edit and get the data in SPlunk for tanium</P> Mon, 08 Apr 2019 11:29:54 GMT sahiltcs 2019-04-08T11:29:54Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-set-up-configuration-in-SPlunk-for-Tanium/m-p/392970#M6220 <P>I installed Splunk Tanium app in my environment, Can you please help me for the configuration in Splunk for tanium</P> <P>In which configuration file i need to edit and get the data in SPlunk for tanium</P> Mon, 08 Apr 2019 11:29:54 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-set-up-configuration-in-SPlunk-for-Tanium/m-p/392970#M6220 sahiltcs 2019-04-08T11:29:54Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-set-up-configuration-in-SPlunk-for-Tanium/m-p/392971#M6221 <P>Step 1:</P> <UL> <LI>Configure syslog on source(Tanium) side to send logs to syslog.</LI> <LI><A href="https://docs.tanium.com/connect/connect/siem.html">https://docs.tanium.com/connect/connect/siem.html</A></LI> </UL> <P>Step 2:</P> <UL> <LI><P>monitor tanium logs from syslog server</P> <P>inputs.conf on HF: Example</P> <P>[monitor:///syslog/tanium/<EM>/</EM>.log]<BR /> disabled = 0<BR /> followTail = 0<BR /> host =<BR /> host_segment = 3<BR /> index = main<BR /> sourcetype = tanium<BR /> crcSalt = <SOURCE></SOURCE></P></LI> </UL> <P>props.conf exaple on HF</P> <PRE><CODE>[tanium] KV_MODE = json MAX_TIMESTAMP_LOOKAHEAD = 16 NO_BINARY_CHECK = true SEDCMD-strip_prefix = s/^[^{]+//g SHOULD_LINEMERGE = false TIME_FORMAT = %b %d %H:%M:%S TIME_PREFIX = ^ category = Custom disabled = false pulldown_type = true </CODE></PRE> <P>Hope this helps...</P> Mon, 08 Apr 2019 16:04:51 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-set-up-configuration-in-SPlunk-for-Tanium/m-p/392971#M6221 muralikoppula 2019-04-08T16:04:51Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-set-up-configuration-in-SPlunk-for-Tanium/m-p/392972#M6222 <P>Thanks it really helps me <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 09 Apr 2019 04:36:37 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-set-up-configuration-in-SPlunk-for-Tanium/m-p/392972#M6222 sahiltcs 2019-04-09T04:36:37Z