Hi,
We are trying to set up the Linux Auditd App on one of our Search Heads. Currently, there are two Indexers getting Auditd related data and both have linux-auditd and TA_linux-auditd Apps installed. App's have been configured to correctly Index the Audit data in the sourcetype needed, i.e. linux:audit.
Both Indexers have been added as a search peer and are connected to the Search Head. When we use the Linux Audit App on the Search Head, it is only able to see data from first indexer.
SH itself can see both Indexes properly and this was verified using a generic search for sourcetype=linux:audit.
But when we check the auditd_indices, upon which the App relies, it only sees the Index from first indexer.
so, on the Search Head,
sourcetype=linux:audit | top index will list both Indexes
But | inputlookup auditd_indicies will only list one.
On the Search Head, apart from linux-auditd and TA_linux-auditd we also have SA-LinuxAuditd installed to help with correlation. Are there any additional steps involved to make sure auditd can look at all indexes?
When we do the search for auditd_indices locally on the Indexers, the one having issues only reports back a "*" instead of the Index name. The first Indexer correctly lists the underlying Index for the same search.
Thanks,
~ Abhi
