Vmware workspace one (mobile device management (MDM))

[hazem]

our Splunk received logs from Vmware workspace one (mobile device management (MDM)) as syslog messages.

what is the source type  needed to be configured in inputs.conf or is there any addon to assist In parsing? 

[hazem]

Hi @gcusello 

i noticed that Splunk does not support the Add-on for WorkspaceOne.and has no documentation.

is there any supported app to parse the Vmware workspace one-MDM

[gcusello]

Hi @hazem ,

this is the only app for that technology in Splunkbase,

I understand that it isn't supported neither by Splunk and another developer, but this is the only alternative solution than create your own custom add-on, so I hint to use it, eventually customizing it and supporting by yourself.

Ciao.

Giuseppe

[gcusello]

Hi @hazem ,

if you're using the Add-on for WorkspaceOne, you should search the default sourcetype in props.conf, that should be taworkspaceone:log.

Ciao.

Giuseppe