Darktrace connector not showing data on dashboard

[aoweneoecoop]

Hi all, We have installed the darktrace app in the search engine and we have confirmed the data is being sent from darktrace on the relevant port but we have not got any data in the dashboard. the input.conf and props.conf are below but we cannot see why the data is not being populated.

local inputs.conf
[tcp://10511]
connection_host = dns
index = darktrace
sourcetype = darktrace
local props.conf
[darktrace]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
disabled = false

can someone advise why we cant see the data?

[aoweneoecoop · Accepted solution]

I have managed to resolve this

[crebollorodrigu]

Hi,

I analized Darktrace dashboard queries and my current json syslog is not including fields "breachUrl" or "modbreachUrl".

In most of queries is written .... | eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl | ... and this makes empty all queries because is deleting all logs without breachUrl and modbreachUrl

Try to add manually the flag keepempty=true to not to delete logs with these empty fields.
To make it works, all dashboard queries should add this anytime dedup appears:

| eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl keepempty=true |

[richgalloway]

@aoweneoecoop To help future readers, please explain how you resolved the problem.