topic Re: Why are events in the Splunk Add-on for CyberArk not being extracted? in All Apps and Add-ons

Why are events in the Splunk Add-on for CyberArk not being extracted?

stefan1988 — Fri, 27 May 2016 13:54:36 GMT

Why are events in the Splunk Add-on for CyberArk not being extracted?

Re: Why are events in the Splunk Add-on for CyberArk not being extracted?

piebob — Tue, 29 Sep 2020 09:49:21 GMT

Splunk Add-on for CyberArk is missing a space in a REGEX causing events not to be extracted. Please adjust the TA into:
[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7

Re: Why are events in the Splunk Add-on for CyberArk not being extracted?

piebob — Fri, 27 May 2016 14:19:50 GMT

thanks, there wasn't a way to make you also the answerer, stefan. in the future, please try and post as questions and answers. 🙂

Re: Why are events in the Splunk Add-on for CyberArk not being extracted?

asartori — Mon, 22 Aug 2016 08:57:15 GMT

Hello,

should i change the regex on every node of a distributed installation? Could you please change this in the Addon and release a new version? Would be really usefully.

regards
Andreas

Re: Why are events in the Splunk Add-on for CyberArk not being extracted?

stefan1988 — Fri, 04 Nov 2016 12:51:53 GMT

Hello Andreas,

You cant put this on your SH, that will do.

regards
Stefan

Re: Why are events in the Splunk Add-on for CyberArk not being extracted?

ChadLangUAB — Wed, 30 Sep 2020 01:14:10 GMT

My fields are still not being extracted!

I replaced the original text with the Answers text:

[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7

in:

/opt/splunk/etc/apps/Splunk_TA_cyberark/default/transforms.conf

Is there something I'm missing here? any help is greatly appreciated.