Greetings -
I do have the TA for nix.
I spend a couple of hours scouring all my resources and looking at the TA_nix where to insert or turn an entry for the OS type.
On the linux side need to know if what vendor : centos/RHEL , version 6,7,8 .
Any input would be appreciated.
sourcetype=Unix:Version has a bunch of the fields (os_*) you are looking for. I am not sure the distribution name is part of that dataset, since there is no standard way of figuring that out across all *nix platforms. Do have that sourcetype in your indexed data?
sourcetype=Unix:Version has a bunch of the fields (os_*) you are looking for. I am not sure the distribution name is part of that dataset, since there is no standard way of figuring that out across all *nix platforms. Do have that sourcetype in your indexed data?