All Apps and Add-ons

How should the Fireyeye app be installed in a distributed environment?

Path Finder


I would like to ingest data from a Fireeye HX, viewing the data either in the Fireeye app or through our own dashboards.   However, although the data is being indexed the fields are not being extracted/labelled in a useful way.

  • I  am running Splunk 8.2.2 on Linux.   I have an indexer cluster and SH cluster.
  • I am using the latest app version, 3.8.8.
  • The Fireeye HX is sending data via TCP in CEF format.

On the CM:

# cat etc/master-apps/_cluster/local/inputs.conf
index = fe_data
sourcetype = hx_ce_syslog
# ls etc/master-apps/FireEye_v3
appserver bin default lookups metadata static

I created local versions of props.conf and transforms.conf

In props.conf I uncommented this line as instructed (as we want the data in our own index).

# Uncomment the next line to send FireEye data to a separate index called "fireeye"
TRANSFORMS-updateFireEyeIndex = fix_FireEye_CEF_in, fix_FireEye_CSV_in, fix_FireEye_XML_in, fix_FireEye_JSON_st, fix_HX_CEF_in, fix_HX2_CEF_in

In transforms.conf I changed entries like this to use our index:


Q: Did I need to change FORMAT to use our index if I have specified the index in inputs.conf?

Q: Am I right in thinking I don't need the FireEye app installed on the SHC if I don't want to use the app there?  i.e. it is enough for the indexers to use the app's conifguration to parse the data.

Q: If the above is correct, does anyone know why the fields are not being extracted as, for example, cef_name?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...