Cisco eStreamer - Some IPS events have incorrect SID

datorres — Thu, 11 Jan 2018 23:06:28 GMT

Versions

Splunk Enterprise v7.0.0
Cisco eStreamer eNcore v3.0.0

Problem

I currently have an issue where eStreamer data for IPS events are showing an incorrect value for sid in alert data. The majority of entries do have the correct sid value, but some don't. In the cases where it doesn't, there's a metadata record that shows up in the logs that provides an id field (showing up as sid in IPS events) and then the correct sid field. Here's an example:

eStreamer appears to be logging the correct sid everywhere else in our environment; Splunk is the only one that isn't.

Expected Result

Ideally, we would like to have IPS events have the actual sid in that field, not the internal database id.

Anyone happen to have a solution to this? Any help would be greatly appreciated.

topic Cisco eStreamer - Some IPS events have incorrect SID in Getting Data In

Cisco eStreamer - Some IPS events have incorrect SID

Versions

Problem

Expected Result