All Apps and Add-ons

Estreamer not mapping the src_ip or dest_ip

clozach
Path Finder

Hi all,

Weird issue here where all fields are being mapped besides possibly the most important ones (src_ip and dest_ip). Not sure what I could do to make these field appear, so I thought I'd post it here. Let me know if you have any suggestions.

0 Karma

lakshman239
Influencer

I assume you are using https://splunkbase.splunk.com/app/1808 and https://splunkbase.splunk.com/app/3662/ . The later collects the data [ has CIM fields as well] and we will need following rename in local/props.conf on the later app to use cisco:sourcefire sourcetypes and CIM fields. You will then have src/src_ip/dest/dest_ip. Additionally, if you know your source and dest are IPs, you can alias or coalesce them to map to src_ip and dest_ip.
//props.conf

[cisco:estreamer:data]
rename = cisco:sourcefire
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...