Linux Logs

[sinhashubham014]

I am working on Linux based usecases that are available in Splunk ESCU. Most of the usecases are using Endpoint. process data model. When checked in the official Splunk Linux add on, only 3 source types are shown in Endpoint i.e. (fs_notification, netstat, Unix:Service), Whereas the "process" sourcetype is not mapped with any data model. Will adding "process" sourcetype help in executing the Splunk ESCU queries?

[richgalloway · Accepted solution]

Don't modify the datamodel.  If you do then your local copy will override any future changes delivered by Splunk.

First, make sure the data in your "process" events apply to the Endpoint DM.  There may be too few common fields to make the DM useful.

If there is sufficient coverage in the DM for your data then use tags to ensure the DM finds the process events in its searches.  Define fieldaliases and EVALs as needed to make the data CIM-compliant.