Hi all, We have installed the darktrace app in the search engine and we have confirmed the data is being sent from darktrace on the relevant port but we have not got any data in the dashboard. the input.conf and props.conf are below but we cannot see why the data is not being populated.
local inputs.conf
[tcp://10511]
connection_host = dns
index = darktrace
sourcetype = darktrace
local props.conf
[darktrace]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
disabled = false
can someone advise why we cant see the data?
↧