All Apps and Add-ons

Rubrik Splunk Add-On: Logs from cluster showing up as sourcetypes

Path Finder

I'm setting up the rubrik app,
and it's assuming I've got sourcetypes of rubrik (sourcetype="rubrik:eventfeed") coming in.

I do have logs coming from our rubrik cluster but they are not showing up as that.

Do I need to change something on the clusters, Splunk or edit the instructions?

Sorry, I'm a Splunk noob.

0 Karma

Esteemed Legend

You can either edit the app and change all the places that say sourcetype="rubrik:eventfeed" OR you can CLONE_SOURCETYPE in transforms.conf

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...