All Apps and Add-ons

CIM is not getting validated after Splunk upgrade from 6.3 to 6.4.1

bagarwal
Path Finder

I have upgraded Splunk from 6.3 to 6.4.1 and I found CIM validation is not looking good (Refer below screen shot). It is showing event coverage less than 90 % and CIM is not validated. However, before upgrading, it was well and good for the corresponding fields (Refer 2nd screen shot below).

I am not sure where went wrong and why CIM is not validating the events. If anyone can please help me out, it would be of great help. Thanks in advance.

alt text

alt text

0 Karma

doksu
Contributor

This is caused by Enterprise Security's app import regex: https://github.com/doksu/splunk_auditd/wiki/Release-Notes#known-issues

I would suggest creating a local app_regex in the Enterprise Security app:

SplunkEnterpriseSecuritySuite/local/inputs.conf:

[app_imports_update://update_es]
app_regex = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)|(TA_.*)
disabled = 0

Please see https://github.com/doksu/splunk_auditd/issues/11 for more discussion about the issue.

0 Karma

doksu
Contributor

Which version of the TA_linux-auditd app is installed?

Which version of the CIM app is installed?

If you run the search: eventtype=auditd_events in "Smart Mode", do you see the normal list of fields on the left-hand side?

0 Karma

bagarwal
Path Finder

Which version of the TA_linux-auditd app is installed?
Current Application: Linux Auditd
App Version
2.0.2

Which version of the CIM app is installed?

Target CIM version: 4.3.1

Current Application: SA-cim_validator
App Version
1.0
App Build
1

If you run the search: eventtype=auditd_events in "Smart Mode", do you see the normal list of fields on the left-hand side?
Yes, can see only on Search & Reporting app and Linux_auditd app. But there is no search result in CIM app and ES app.

Please help.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...