All Apps and Add-ons

Why are events in the Splunk Add-on for CyberArk not being extracted?

stefan1988
Path Finder

Why are events in the Splunk Add-on for CyberArk not being extracted?

0 Karma
1 Solution

piebob
Splunk Employee
Splunk Employee

Splunk Add-on for CyberArk is missing a space in a REGEX causing events not to be extracted. Please adjust the TA into:
[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7

View solution in original post

ChadLangUAB
Path Finder

My fields are still not being extracted!

I replaced the original text with the Answers text:

[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7

in:

/opt/splunk/etc/apps/Splunk_TA_cyberark/default/transforms.conf

Is there something I'm missing here? any help is greatly appreciated.

0 Karma

piebob
Splunk Employee
Splunk Employee

Splunk Add-on for CyberArk is missing a space in a REGEX causing events not to be extracted. Please adjust the TA into:
[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7

piebob
Splunk Employee
Splunk Employee

thanks, there wasn't a way to make you also the answerer, stefan. in the future, please try and post as questions and answers. 🙂

0 Karma

asartori
New Member

Hello,

should i change the regex on every node of a distributed installation? Could you please change this in the Addon and release a new version? Would be really usefully.

regards
Andreas

0 Karma

stefan1988
Path Finder

Hello Andreas,

You cant put this on your SH, that will do.

regards
Stefan

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...