All Apps and Add-ons

FireEye app and eMPS

Path Finder


I hope someone has had success with this. I've gotten the FireEye app up and working with the xml alerts from our WebMPS, so I added reporting from our email MPS.
The data shows up in Splunk, but the FireEye app does not see this data for some reason.
I haven't started digging much in the problem, but I suspect that there are some fields that differ between these two.

Has anyone else looked into this?


Tags (2)
0 Karma

Path Finder


I've looked into this a little bit. The FireEye app on SplunkBase seems to be pretty outdated and not very good. If you look at the props.conf and transforms.conf that are included you'll see that the field extractions don't seem to address the email MPS alerts at all. For example, there's no extraction for the source email address.

If you have the logs in XML format, you can use "kv_mode = xml" in props.conf to automatically extract all the XML fields. The automatic extraction tends to yield very complicated field names. This is kind of messy, but you can make it a little better by creating field aliases to give simpler names to the fields you really care about.

0 Karma

Path Finder

Thanks for the tip on kv_mode. I was starting to look in that direction myself.
It's going to be a bit time consuming I think, but I'll see what I can do.

I can always hope that the "official" app is updated 🙂

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...