Splunk McAfee ePo Rising Column

satiex · ‎03-20-2018

Hi,

Could somoene please tell me the best rising column to use with the McAfee? I had it on timestamp but found I was getting lots of duplicate events indexed, would AutoID be a better option? I'm using DB Connect 3 and it otherwise seems to be working.

Thank you.

p_gurav · ‎03-22-2018

Hi,

This may help you:

http://docs.splunk.com/Documentation/AddOns/released/McAfeeEPO/ConfigureDBConnectv2inputs

Splunk McAfee ePo Rising Column

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

Splunk McAfee ePo Rising Column

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever