Carbon Black Cloud App for Splunk SIEM Macros

Carbon Black Cloud includes the following macros that control dashboard searches.

• vmware_tstats

  vmware_tstats is the default macro that is used in all searches on dashboards. By default, it is configured as:

  tstats prestats=false local=false summariesonly='VMWare_CBC_summariesonly'

• vmware_tstats_pre

  vmware_tstats_pre is the same as vmware_tstats except that prestats=true.

  To use this macro to search dashboards, replace vmware_tstats with vmware_tstats_pre in all applicable dashboards.

• VMWare_CBC_summariesonly

  This macro controls whether summariesonly is set to true in the vmware_tstats and vmware_tstats_pre macros. By default, summariesonly=false. Enabling summariesonly improves the performance of searches on the dashboards.

  To enable summaries only, create $SPLUNK_HOME$/etc/apps/vmware_app_for_splunk/local/macros.conf and add the following stanza:

  [VMWare_CBC_summaries_only]
  definition = "true"