Why are events in the Splunk Add-on for CyberArk not being extracted?
Splunk Add-on for CyberArk is missing a space in a REGEX causing events not to be extracted. Please adjust the TA into:
[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7
My fields are still not being extracted!
I replaced the original text with the Answers text:
[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7
in:
/opt/splunk/etc/apps/Splunk_TA_cyberark/default/transforms.conf
Is there something I'm missing here? any help is greatly appreciated.
Splunk Add-on for CyberArk is missing a space in a REGEX causing events not to be extracted. Please adjust the TA into:
[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7
thanks, there wasn't a way to make you also the answerer, stefan. in the future, please try and post as questions and answers. 🙂
Hello,
should i change the regex on every node of a distributed installation? Could you please change this in the Addon and release a new version? Would be really usefully.
regards
Andreas
Hello Andreas,
You cant put this on your SH, that will do.
regards
Stefan