All Apps and Add-ons

Darktrace connector not showing data on dashboard

Explorer

Hi all, We have installed the darktrace app in the search engine and we have confirmed the data is being sent from darktrace on the relevant port but we have not got any data in the dashboard. the input.conf and props.conf are below but we cannot see why the data is not being populated.

local inputs.conf
[tcp://10511]
connection_host = dns
index = darktrace
sourcetype = darktrace
local props.conf
[darktrace]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
disabled = false

can someone advise why we cant see the data?

0 Karma
1 Solution

Explorer

I have managed to resolve this

View solution in original post

0 Karma

Explorer

I have managed to resolve this

View solution in original post

0 Karma

New Member

Hi,

I analized Darktrace dashboard queries and my current json syslog is not including fields "breachUrl" or "modbreachUrl".

In most of queries is written .... | eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl | ... and this makes empty all queries because is deleting all logs without breachUrl and modbreachUrl

Try to add manually the flag keepempty=true to not to delete logs with these empty fields.
To make it works, all dashboard queries should add this anytime dedup appears:

| eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl keepempty=true |

0 Karma

SplunkTrust
SplunkTrust

@aoweneoecoop To help future readers, please explain how you resolved the problem.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!