All Apps and Add-ons

The rule FIELDALIAS is wrong in the Splunk app for Check Point

ckurtz
Path Finder

The props.conf FIELDALIAS for the field "rule" is bad, in both in [opsec] and [opsec:vpn]: (at least for v77 Firewalls)

FIELDALIAS-rule_for_opsec      = policy_name as rule

This overwrites the default key=value field for the "rule" field, a numeric field in the data. In an ideal world we could get a rule # to rule name definition from the Firewalls in some lookup table, but most CP Admins know their rule #s pretty well...

0 Karma
1 Solution

ckurtz
Path Finder

The temporary fix (until the app is updated) is to add the following to a local/props.conf file:

[opsec]
FIELDALIAS-rule_for_opsec      = 
[opsec:vpn]
FIELDALIAS-rule_for_opsec      = 

H/T to Fellow SplunkTrustee @dshpritz for the FIELDALIAS kung foo!

View solution in original post

ckurtz
Path Finder

The temporary fix (until the app is updated) is to add the following to a local/props.conf file:

[opsec]
FIELDALIAS-rule_for_opsec      = 
[opsec:vpn]
FIELDALIAS-rule_for_opsec      = 

H/T to Fellow SplunkTrustee @dshpritz for the FIELDALIAS kung foo!

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...