Splunk Enterprise Security

Event from add-on Splunk app Windows source without domain name

ibabansk
Loves-to-Learn

Good afternoon! Splunk Add-on for Microsoft Windows version 8.0.0 Splunk TA Windows, generates a data source without a domain name, i.e. just a host name. How can I bulk configure to display hostname with domain e.g. pc1.domain.com. Use in server.conf - hostnameOption = fullyqualifiedname, you can not because you need to distribute the configuration on a large number of PC
via forwarder manager. Such a setup can be done through props and transformer

Labels (1)
0 Karma

ibabansk
Loves-to-Learn

Thank you for the solution provided, but unfortunately it is not applicable. The thing is that in fact we get two event sources Computer1 and Computer1.local.domain. If you disable Splunk Add-on for Microsoft, all events come from the source Computer1.local.domain

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

This isn't exactly the answer to the question that you've asked, but if you're using Enterprise Security, it sounds like you could possibly use entity zones to help specify your different domains: 
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Entityzones

Let me know if that helps. 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...