I would like to ingest data from a Fireeye HX, viewing the data either in the Fireeye app or through our own dashboards. However, although the data is being indexed the fields are not being extracted/labelled in a useful way.
I am running Splunk 8.2.2 on Linux. I have an indexer cluster and SH cluster.
I am using the latest app version, 3.8.8.
The Fireeye HX is sending data via TCP in CEF format.
# ls etc/master-apps/FireEye_v3 appserver bin default lookups metadata README.md static
I created local versions of props.conf and transforms.conf .
In props.conf I uncommented this line as instructed (as we want the data in our own index).
# Uncomment the next line to send FireEye data to a separate index called "fireeye" TRANSFORMS-updateFireEyeIndex = fix_FireEye_CEF_in, fix_FireEye_CSV_in, fix_FireEye_XML_in, fix_FireEye_JSON_st, fix_HX_CEF_in, fix_HX2_CEF_in
In transforms.conf I changed entries like this to use our index: