Why are events in the Splunk Add-on for CyberArk not being extracted?

[stefan1988]

Why are events in the Splunk Add-on for CyberArk not being extracted?

[ChadLangUAB]

My fields are still not being extracted!

I replaced the original text with the Answers text:

[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7

in:

/opt/splunk/etc/apps/Splunk_TA_cyberark/default/transforms.conf

Is there something I'm missing here? any help is greatly appreciated.

[piebob · Accepted solution]

Splunk Add-on for CyberArk is missing a space in a REGEX causing events not to be extracted. Please adjust the TA into:
[cyberark_epv_cef_cyberark_pta_cef_extract_field_0]
REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.*
FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7

[piebob]

thanks, there wasn't a way to make you also the answerer, stefan. in the future, please try and post as questions and answers. 🙂

[asartori]

Hello,

should i change the regex on every node of a distributed installation? Could you please change this in the Addon and release a new version? Would be really usefully.

regards
Andreas

[stefan1988]

Hello Andreas,

You cant put this on your SH, that will do.

regards
Stefan