Splunk-Apps icon indicating copy to clipboard operation
Splunk-Apps copied to clipboard

Some log types use "type" field.

Open paulmnguyen opened this issue 3 years ago • 0 comments

Describe the bug

Currently we should be using log_type as the field to define the type of log it is. We have HIPMATCH, USERID, GLOBALPROTECT logs that are still using "type".

Expected behavior

Change remaining logs to use "log_type"

Current behavior

Customers have to make searches based on type or log_type.

Possible solution

Update transforms.conf to use log_type on all logs. Then update dashboards and datamodels to reflect the change.

Context

This has been reported by customers. This was introduced in 7.1.0 of the app.

paulmnguyen avatar Aug 31 '22 16:08 paulmnguyen