Splunk Enterprise Security

Event from add-on Splunk app Windows source without domain name

ibabansk
Loves-to-Learn

Good afternoon! Splunk Add-on for Microsoft Windows version 8.0.0 Splunk TA Windows, generates a data source without a domain name, i.e. just a host name. How can I bulk configure to display hostname with domain e.g. pc1.domain.com. Use in server.conf - hostnameOption = fullyqualifiedname, you can not because you need to distribute the configuration on a large number of PC
via forwarder manager. Such a setup can be done through props and transformer

Labels (1)
0 Karma

ibabansk
Loves-to-Learn

Thank you for the solution provided, but unfortunately it is not applicable. The thing is that in fact we get two event sources Computer1 and Computer1.local.domain. If you disable Splunk Add-on for Microsoft, all events come from the source Computer1.local.domain

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

This isn't exactly the answer to the question that you've asked, but if you're using Enterprise Security, it sounds like you could possibly use entity zones to help specify your different domains: 
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Entityzones

Let me know if that helps. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...