All Apps and Add-ons

TA Falcon FileVantage bug in version 2.1.0 - events merged -> proposal of fix

FloSwiip
Path Finder


CrowdStrike Falcon FileVantage Technical Add-On
https://splunkbase.splunk.com/app/7090

When the api return more than one event, the result in splunk is one event with the all jsons merged together making splunk json parsing to fail.

For the python code it is seem to be what was wished with the join here  :

 

 

 

 

~/etc/apps/TA_crowdstrike_falcon_filevantage/bin/TA_crowdstrike_falcon_filevantage_rh_crowdstrike_filevantage_json.py

        try:
            helper.log_info(f"{log_label}: Preparing to send: {len(event_data)} FileVantage events to Splunk index: {data_index}")
 -->           events = '\n'.join(json.dumps(line) for line in event_data)
            filevantage_data = helper.new_event(source=helper.get_input_type(), index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=events)
            ew.write_event(filevantage_data)
            helper.log_info(f"{log_label}: Data for {len(event_data)} events from FileVantage successfully pushed to Splunk index: {data_index}")

 

 

 

 

 

So it is important to make a proper splunk props.conf to un-split events with a LINE_BREAKER :

 

 

 

 

 

splunk@ncesplkpoc01:~/etc/apps/TA_crowdstrike_falcon_filevantage$ cat local/props.conf 
[crowdstrike:filevantage:json]
SHOULD_LINEMERGE = false
LINE_BREAKER = \n
NO_BINARY_CHECK = true

 

 

 

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...