I am planning to integrate BeyondTrust Retina to Splunk and would like to know the process. Currently, the logs are coming coming to Splunk via primary server and not with the Retina DB. I have seen there is a Splunk document for integration of scanner logs directly to Splunk but here we have multiple scanners. The reason for this change is we are not receiving all fields in splunk for retina logs. I would like to know
1 the process of integrating Retina DB with Splunk server that will help in getting all the log fields.
2 How can we segregate the log fields to the ones I require within event logs during generation??
Thanks
