All Apps and Add-ons

Help with darktrace extraction with darktrace connector

dfall
Loves-to-Learn

Hello,

I have a problem with daktrace collector.

Monitor logs Darktrace

Logs Darktrace

[monitor:///srv/syslogdata/darktrace/]
disabled = false
recursive = true
index = darktrace
sourcetype = darktrace:syslog
whitelist = \.log$
host_segment = 4
The data arrives in Splunk However the field of extraction does not work.
the conf props.conf  in .../Darktrace/defaults/ in syslog is:
[darktrace]
pulldown_type = true
KV_MODE = json
category = Structured
description = Darktrace JSON syslog format.
SEDCMD-remove_header = s/^[^\{]+//

I have an architecture with utility server, search head, cluster indexers, syslog+UF (darktrace).
I need some help, please.
Thank you in advance.

0 Karma

lznger88_2
Path Finder

Hi All,

Was the issue resolved. I ask as I currently have extractions issues but not having any luck with resolving it. 

0 Karma

alonsocaio
Contributor

Hello,

How are you sending Darktrace logs to Splunk? When I deployed the connector I have used a TCP port to perform the input. The props.conf in default folder is just like yours. But in the local folder there are some other configs:

local/props.conf:

DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
disabled = false

My inputs.conf:

[tcp://5515]
connection_host = dns
index = darktrace
sourcetype = darktrace
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...