Files
parsedmarc/docs/source/splunk.md
Ben Companjen 2b35b785c6 Split and Organise documentation files (#404)
* Set global TOC collapse to false

* Split documentation

I tried to split the index.md file into logical parts, not changing the contents.
I did add a space and change one HTTP URL to HTTPS.

---------

Co-authored-by: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
2023-05-03 16:11:58 -04:00

796 B

Splunk

Starting in version 4.3.0 parsedmarc supports sending aggregate and/or forensic DMARC data to a Splunk HTTP Event collector (HEC).

The project repository contains XML files for premade Splunk dashboards for aggregate and forensic DMARC reports.

Copy and paste the contents of each file into a separate Splunk dashboard XML editor.

:::{warning} Change all occurrences of index="email" in the XML to match your own index name. :::

The Splunk dashboards display the same content and layout as the Kibana dashboards, although the Kibana dashboards have slightly easier and more flexible filtering options.