topic Re: Check Point App for Splunk: duplicated field values in Knowledge Management

Check Point App for Splunk: duplicated field values?

gcusello — Mon, 27 Feb 2023 14:32:14 GMT

Hi at all,

I installed the Check Point App for Splunk and I found a strange behaviour:

at first the name is "Check Point App for Splunk" but the folder name is "TA-check-point-app-for-splunk" ,that's strange: it's an App or a TA?

But this isn't my problem:

installing this app I found that, for each event, there are some fields (date, time and rule_action) that are duplicated with the same value, in other words, for each event there is two times the same field and the same value (e.g. rule_action="allowed").

Has anyone encountered this problem?

Ciao and thanks,

Giuseppe

Re: Check Point App for Splunk: duplicated field values

VatsalJagani — Thu, 10 Feb 2022 06:23:10 GMT

I've seen the behavior sometimes when you use `| extract reload=T` in the search but not sure if it's due to that or something else.

Re: Check Point App for Splunk: duplicated field values

bharathkumarnec — Mon, 27 Feb 2023 10:37:18 GMT

Hi @gcusello ,

Are you referring to the raw events that contains duplicates? If it is in the raw event, then it is nothing to do with the TA or Add-on? If it is with the raw event itself, may be worth to check the source of the data that is sending the logs to splunk...

Only these three fields are having the duplicates or any other fields?

Re: Check Point App for Splunk: duplicated field values

gcusello — Tue, 28 Feb 2023 07:36:56 GMT

Hi @bharathkumarnec,

no only these three fields.

Ciao.

Giuseppe

Re: Check Point App for Splunk: duplicated field values

bharathkumarnec — Tue, 28 Feb 2023 14:12:23 GMT

Hi @gcusello ,

I have noticed the same behaviour, but when i unistalled the app/addon still i see duplicated fields but they are in my raw event as well.

Regards,

Bharath Kumar ASN