All Apps and Add-ons

Darktrace connector not showing data on dashboard

aoweneoecoop
Explorer

Hi all, We have installed the darktrace app in the search engine and we have confirmed the data is being sent from darktrace on the relevant port but we have not got any data in the dashboard. the input.conf and props.conf are below but we cannot see why the data is not being populated.

local inputs.conf
[tcp://10511]
connection_host = dns
index = darktrace
sourcetype = darktrace
local props.conf
[darktrace]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
disabled = false

can someone advise why we cant see the data?

0 Karma
1 Solution

aoweneoecoop
Explorer

I have managed to resolve this

View solution in original post

0 Karma

aoweneoecoop
Explorer

I have managed to resolve this

0 Karma

crebollorodrigu
New Member

Hi,

I analized Darktrace dashboard queries and my current json syslog is not including fields "breachUrl" or "modbreachUrl".

In most of queries is written .... | eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl | ... and this makes empty all queries because is deleting all logs without breachUrl and modbreachUrl

Try to add manually the flag keepempty=true to not to delete logs with these empty fields.
To make it works, all dashboard queries should add this anytime dedup appears:

| eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl keepempty=true |

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@aoweneoecoop To help future readers, please explain how you resolved the problem.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...