Is Auditd compatible with Splunk 7.1.1?

[jacobsmith14]

I see it does not explicitly list 7.1 in Splunkbase. Does anyone have this running with 7.1.1?

Thanks!

[felipesewaybric]

Yes, is fully compatible.

[woodcock]

The author is just late in updating his splunkbase entry. The very simplified app contains nothing that would be incompatible with v7.1 splunk, as is the case with most inputs/CIM-based apps. What do you say, @trustedsubject?

[MonkeyK]

Should be compatible. As I understand it, AuditD logs are sent via syslog. Any field extractions are defined in the app, so the new version of Splunk should have nothing to do with it.

[vidhyaArumalla]

I agree with @MonkeyK