Splunk and cascade

[sulaimanbale]

May i know what is app ? and how can i connect my splunk server to cascade?

[unkempthenry]

Hi @sulaimanbale,

In the cascade-server code that interacts with Splunk, the app parameter is passed into the Splunk Python SDK: see https://docs.splunk.com/DocumentationStatic/PythonSDK/1.1/client.html it is described as:

app (string) – The app context of the namespace (optional).

If your Splunk deployment doesn't require defining an app, then you can leave this blank.

[sulaimanbale11]

Hi, I have sysmon setup in splunk and how can I connect t it to cascade ?

What do I fill up for app configuration?

[unkempthenry]

You can leave app configuration blank.

Cascade probably won't be able to see much from a default Splunk installation. I'm asking around to see if there's a released Splunk app / configuration that will work.

[sulaimanbale]

Okay

[sulaimanbale]

After doing so how do i get sysmon splunk logs in cascade?