Getting Data In

Fields in Splunk Cloud from Heavy Forwarder (Add-on Windows and Linux)

sachaz
Explorer

I've installed Splunk Add-on for Windows and Splunk Add-on for Unix and Linux in the Heavy forwarder. I only edited inputs.conf file with the routes I want to monitor, but whit the sourcetype linux_secure and bash_history, when I check on my Splunk Cloud the are no fields like "src", "dest", etc. I'm missing something? Any ideas how to resolve this?

0 Karma

vliggio
Communicator

The src and dest field extractions take place at search time, so you have to put a ticket in and request that Splunk install the add-ons on to your Splunk Cloud environment. If you look in the Splunk_TA_nix, you'll see the props.conf has a bunch of FIELDALIAS settings, which, if you refer to https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings, you will see that FIELDALIAS is a search time configuration.

sachaz
Explorer

I'm waiting for a few days ago the splunk support response, I was in doubt if I should do something else before, thanks

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...