All Apps and Add-ons

Rubrik Splunk Add-On: Logs from cluster showing up as sourcetypes

bigfatyeastroll
Path Finder

I'm setting up the rubrik app,
(https://github.com/rubrikinc/rubrik-addon-for-splunk/blob/master/docs/quick-start.md)
and it's assuming I've got sourcetypes of rubrik (sourcetype="rubrik:eventfeed") coming in.

I do have logs coming from our rubrik cluster but they are not showing up as that.

Do I need to change something on the clusters, Splunk or edit the instructions?

Sorry, I'm a Splunk noob.

0 Karma

woodcock
Esteemed Legend

You can either edit the app and change all the places that say sourcetype="rubrik:eventfeed" OR you can CLONE_SOURCETYPE in transforms.conf

0 Karma
Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...