All Apps and Add-ons

Tripwire Enterprise App for Splunk Enterprise: Why are tags associated with event types not being applied?


I'm using the Tripwire Enterprise App for Splunk Enterprise.

I have an event type called "te_fim". Its search string is: index=te sourcetype=te_fim_csv. It applies three tags: attack, change, endpoint.

If I run a search on eventtype=te_fim, I see the matching events, but the tag field never shows up.

I do see that some of the event types/tags that ship with the app are working. The only thing different about them is that their owner is "admin" instead of "No owner".

Any ideas why this isn't working? Or how to change the owner of an event type?

0 Karma


Perhaps you need to check the permissions/exports on the application ?

You can change the owner of an event type, I believe this would work but I have not tested it:
First you need to find the relevant eventtype, I would do this by looking at:

Or the relevant application.

curl -k -u admin:changeme -d 'owner=foo' -d 'sharing=app' https://localhost:8089/servicesNS/admin/Splunk_TA_aws/saved/eventtypes/event1/acl

You might want to check the event types are exported in the metadata:

export = system

I would expect something like that in the default.meta file of the metadata directory of the application if you expect the event types to be visible in all applications...

Alerts for Splunk Admins
Version Control for Splunk
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!