Dear Support
I have downloaded Splunk Add-on for Sysmon.
I am also using Sysmon App for Splunk - which requires the prior.
My sysmon data are stored on an index named os_sysmon.
Some dashboards of Sysmon App for Splunk show empty, because they rely on a field named EventDescription.
I did check deployment of Splunk Add-on for Sysmon, under folder lookups, and did find there a file named microsoft_sysmon_eventcode.csv just as doc:
Lookups for the Splunk Add-on for Sysmon
... says
The file is populated with 28 entries and has two fields:
EventCode and EventDescription
when I search my index:
index = os_sysmon
I do get field EventCode, but not the EventDescription
(the same is for lookup file microsoft_sysmon_record_type.csv - I do have record_type but not the record_type_name)
Now, the Sysmon App for Splunk has only one macro - named sysmon - with an original sourcetype=....., which I changed to index=sysmon.
No try to derivate any EventDescription field from EventCode via the lookup file.
Seems strange that developers of Sysmon App for Splunk forgot to create (eval) used field EventDescription from EventCode (via lookup) in their only macro.
Should I do it myself there, or is it something to fix at Splunk Add-on for Sysmon - and how?
best regards
Altin
