All Apps and Add-ons

Is it possible to add additional CEF fields for output to Arcsight?

bradp1234
Path Finder

I am attempting to map Microsoft TMG logs to CEF with the Splunk app for CEF and I am not able to map the requestURL field. It is not an option in the dropdown box. How can I add this field? Is it a text file within the app?

Tags (1)
1 Solution

matthieu_araman
Communicator

Hello,

I add the same pb as you.
There are missing cef fields in the choices proposed by the app.

I found the following solution :
to add a custom cef field, open up cef_inventory.csv file in the splunk_app_cef/lookups directory
first line describe the line format (cef_key,splunk_key,full_name,friendly_name,data_type,length,meaning,location,cef_value_type,required_related_field,required_field)

you can test by duplicating a line and modifying it.
first columm is your cef field name
second one is the splunk name (it looks like the app will try to match if the name in the data model contains this splunk name)
after editing the file, just reloading the editing url should be enough to make it appears

there are also comments associated to the fileds in the file which are useful.(they don't seem to appear in the web form)

hope that helps

View solution in original post

matthieu_araman
Communicator

Hello,

I add the same pb as you.
There are missing cef fields in the choices proposed by the app.

I found the following solution :
to add a custom cef field, open up cef_inventory.csv file in the splunk_app_cef/lookups directory
first line describe the line format (cef_key,splunk_key,full_name,friendly_name,data_type,length,meaning,location,cef_value_type,required_related_field,required_field)

you can test by duplicating a line and modifying it.
first columm is your cef field name
second one is the splunk name (it looks like the app will try to match if the name in the data model contains this splunk name)
after editing the file, just reloading the editing url should be enough to make it appears

there are also comments associated to the fileds in the file which are useful.(they don't seem to appear in the web form)

hope that helps

sbrant_splunk
Splunk Employee
Splunk Employee

The Splunk app for CEF relies on data models to pull data from, so what you're seeing in the dropdowns are the fields that exist in data models currently defined on your Splunk instance. If the data models that you have do not contain the desired fields, you can always create a new data model that does.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...