Splunk Security Essentials v3.0.3 changes "source"...

All Apps and Add-ons

This is done in $SPLUNK_HOME/apps/Splunk_TA_nix/local/inputs.confand this is in "Splunk Add-on for Unix and Linux" in version 7.0.0 but I think that actually doesn't matter.

I found that the change comes from $SPLUNK_HOME/apps/Splunk_Security_Essentials/appserver/static/data_source.js (in line 1106 for v3.0.3). All other "source"-values for "monitor"-stanzas stay correct, i.e left unchanged at their default. This "secure"-source really should also stay at its original value, i.e. source=/var/log/secure.

Or is there a really good reason?

Get Updates on the Splunk Community!

Splunk Security Essentials v3.0.3 changes "source" for "monitor:///var/log/secure" in Splunk_TA_nix. Why?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation