mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-07-29 20:04:56 +00:00
a421747a79
Adds a dropdown that filters every panel on the published DMARC policy (published_policy.p) or subdomain policy (published_policy.sp), mirroring the Message disposition dropdown's choices and default and sitting immediately before it, per the issue spec. Both fields are always present on parsedmarc-written events (sp defaults to p in the parser), so the wildcard default matches everything, consistent with the other raw-search filters. Also fixes the Splunk docs page's XML-files link, which still pointed at the pre-#736 splunk/ path and 404ed. Closes #854 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
23 lines
803 B
Markdown
23 lines
803 B
Markdown
# Splunk
|
|
|
|
Starting in version 4.3.0 `parsedmarc` supports sending aggregate and/or
|
|
failure DMARC data to a Splunk [HTTP Event collector (HEC)].
|
|
|
|
The project repository contains [XML files] for premade Splunk
|
|
dashboards for aggregate and failure DMARC reports.
|
|
|
|
Copy and paste the contents of each file into a separate Splunk
|
|
dashboard XML editor.
|
|
|
|
:::{warning}
|
|
Change all occurrences of `index="email"` in the XML to
|
|
match your own index name.
|
|
:::
|
|
|
|
The Splunk dashboards display the same content and layout as the
|
|
Kibana dashboards, although the Kibana dashboards have slightly
|
|
easier and more flexible filtering options.
|
|
|
|
[xml files]: https://github.com/domainaware/parsedmarc/tree/master/dashboards/splunk
|
|
[http event collector (hec)]: http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC
|