Splunk Enterprise Security

Event from add-on Splunk app Windows source without domain name

ibabansk
Loves-to-Learn

Good afternoon! Splunk Add-on for Microsoft Windows version 8.0.0 Splunk TA Windows, generates a data source without a domain name, i.e. just a host name. How can I bulk configure to display hostname with domain e.g. pc1.domain.com. Use in server.conf - hostnameOption = fullyqualifiedname, you can not because you need to distribute the configuration on a large number of PC
via forwarder manager. Such a setup can be done through props and transformer

Labels (1)
0 Karma

ibabansk
Loves-to-Learn

Thank you for the solution provided, but unfortunately it is not applicable. The thing is that in fact we get two event sources Computer1 and Computer1.local.domain. If you disable Splunk Add-on for Microsoft, all events come from the source Computer1.local.domain

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

This isn't exactly the answer to the question that you've asked, but if you're using Enterprise Security, it sounds like you could possibly use entity zones to help specify your different domains: 
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Entityzones

Let me know if that helps. 

0 Karma
Get Updates on the Splunk Community!

Holistic Visibility and Effective Alerting Across IT and OT Assets

Instead of effective and unified solutions, they’re left with tool fatigue, disjointed alerts and siloed ...

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...