JasonConger

All the links for Splunk .conf23 session DEV1967B - Containerize Your Splunk App Development

Tools used

• Docker - https://docker.com/
• Podman - https://podman.io/
• Visual Studio Code - https://code.visualstudio.com/
• Visual Studio Code Extensions - https://marketplace.visualstudio.com/vscode

Visual Studio Code Extensions - https://marketplace.visualstudio.com/vscode

• Splunk - https://marketplace.visualstudio.com/items?itemName=Splunk.splunk

JasonConger

[mscs:nsg:flow]
description = Azure NSG Flow Logs
LINE_BREAKER = (,|\[){"time"
category = Application
KV_MODE = json
SEDCMD-remove_footer = s/\]}$//g
SEDCMD-remove_header = s/{"records":\[//g
SHOULD_LINEMERGE = false
TIME_PREFIX = time\":\"
TRUNCATE = 0

JasonConger

{
    "EntryId":  "3_0_3",
    "Date":  "\/Date(1443804400000)\/",
    "Account":  "LAB\\administrator",
    "TaskType":  2,
    "ItemType":  0,
    "ItemName":  "Calc",
    "Description":  "Published application Calc was modified.",
    "Details":  [

JasonConger

# Create a UDL file to access the SQL database
Add-Content C:\conflog.udl –Value $null; Start-Process C:\conflog.udl

# Load the Citrix Common Commands Snapin
Get-PSSnapin -Registered "Citrix.Common.Commands" | Add-PSSnapin

# Get the configuration log and convert to JSON
Get-CtxConfigurationLogReport -DataLinkPath C:\conflog.udl | ConvertTo-Json -Depth 10

JasonConger

[ICA RTT - Yellow]
action.email.reportServerEnabled = 0
action.email.useNSSubject = 1
action.script = 1
action.script.filename = octoblu_trigger.py
alert.digest_mode = True
alert.suppress = 1
alert.suppress.period = 1m
alert.track = 0
counttype = number of events