All Apps and Add-ons

Splunk 5.0.1 and Splunk LEA 2.0.1 log grabber

richfoster
Engager

I have an install of splunk 5.0.1 that was using an old lea-loggrabber app. I have installed the new Splunk support LEA grabber for OPSEC and now seem to have issues with my logs not showing anymore. I can see from tcpdump that the logs are being sent to the splunk server, however they do not show in splunk search. Also when trying to perform a search now I get the following errors
"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'opsec' and lookup table 'checkpoint_action_lookup'.

Tags (1)

krugger
Communicator

It wasn't working for me either.

I solved the problem by rewriting the parsing. This might not be the best solution and it might not work for you, because of diferences in the products. Anyway I hope it helps.

I first renamed the default/props.conf to default/props.bak and default/transforms.conf to default/transforms.bak. Then I created new props.conf nad transforms.conf in the local directory.


props.conf:
[opsec]
SHOULD_LINEMERGE = false
TIME_PREFIX = time=
TIME_FORMAT = %d%b%Y %H:%M:%S
REPORT-opsec = opsec
REPORT-opsec-message = opsec-message

transforms.conf:
[opsec]
REGEX = loc=\d+ filename=\S+ fileid=\d+ time=.\S+ \S+ action=(\S+) orig=(\S+) i\/f_dir=(\S+) i\/f_name=(\S+) has_accounting=\S+ product=(.) __policy_id_tag=.( rule=\d+)?( rule_uid=\S+)?( rule_name=.)?( service_id=\S+)? src=(\S+) s_port=(\S+) dst=(\S+) service=(\S+) proto=(\S+)( message_info=.)?( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)?( NAT_rulenum=\d+)?( NAT_addtnl_rulenum=\d+)?
FORMAT = action::$1 orig::$2 if_dir::$3 if_name::$4 product::$5 src::$6 s_port::$7 dst::$8 service::$9 proto::$10

[opsec-message]
REGEX = proto=\S+ message_info=(.*)( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)?
FORMAT = message::$1

araitz
Splunk Employee
Splunk Employee

I have filed OPSEC-95 and will attempt to reproduce.

UPDATE: I can reproduce the knowledge issues (i.e. the lookup table error). I am still working to reproduce the other knowledge issues.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...