Splunk-Apps
Splunk-Apps copied to clipboard
Some log types use "type" field.
Describe the bug
Currently we should be using log_type as the field to define the type of log it is. We have HIPMATCH, USERID, GLOBALPROTECT logs that are still using "type".
Expected behavior
Change remaining logs to use "log_type"
Current behavior
Customers have to make searches based on type or log_type.
Possible solution
Update transforms.conf to use log_type on all logs. Then update dashboards and datamodels to reflect the change.
Context
This has been reported by customers. This was introduced in 7.1.0 of the app.