All Apps and Add-ons

(Beta) Proofpoint Email Security App for Splunk content returns no results

mdsnmss
SplunkTrust
SplunkTrust

This isn't a question but a post to help point out a reason you may not be seeing content in your reports or dashboards using the (Beta) Proofpoint Email Security App for Splunk. It has to do with a macro used at the beginning of each search in order to set the index. You must change the macro to point to the index where your Proofpoint data (pps__log) is.

1 Solution

mdsnmss
SplunkTrust
SplunkTrust

To change the macro open up Settings-->Advanced Search-->Search macros. Go to the app context "Proofpoint Email Security App for Splunk". There is a macro labeled get_pps_index. The macro is set to explicitly point to index=main. Since it is unlikely you are sending all of your Proofpoint data to "main" you should open this macro and change it to the index where your PPS data is sent.

View solution in original post

eckolp2003
Path Finder

Have you been able to verify you have data coming in? Can you confirm all the steps you have done so far?

The app setup is fairly well documented here:

https://splunkbase.splunk.com/app/3080/#/details

We need to determine if this is a sourcetype issue or some other problem.

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

To change the macro open up Settings-->Advanced Search-->Search macros. Go to the app context "Proofpoint Email Security App for Splunk". There is a macro labeled get_pps_index. The macro is set to explicitly point to index=main. Since it is unlikely you are sending all of your Proofpoint data to "main" you should open this macro and change it to the index where your PPS data is sent.

eckolp2003
Path Finder

Thanks for documenting this for others!

0 Karma

vnguyen46
Contributor

Thank you so much. It's a big help. I have been searching for days to resolve this issue.

0 Karma

jrsanders
Path Finder

Nevermind. I figured it out. I needed to add the Add-on to my indexer as well.

0 Karma

eckolp2003
Path Finder

Could you tell me more about your deployment? Most deployments should not need this installed on an indexer.

0 Karma

jrsanders
Path Finder

Our deployment consist of One Search Head and One Indexer. Our Proofpoint servers send their logs directly to the indexer.

0 Karma

eckolp2003
Path Finder

Ok, that explains why. The TA's should normally go on a heavy forwarder and if you are not using one, they would have to go on your indexer.

0 Karma

jrsanders
Path Finder

Thank you for the input. Sorry about my earlier comment. I was venting a little.

0 Karma

jrsanders
Path Finder

I've done that and I'm still not getting data. Plus there is little to no documentation for this app.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...