Getting Data In

Why are Armis alerts logs not parsing correctly?

AL3Z
Builder

hi,

The Armis alerts in Splunk Cloud appear to be not being parsed correctly. We do have a technology addon for armis installed, how we can troubleshoot ??

Labels (4)
0 Karma

AL3Z
Builder

.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The packet field appears to encoded or encrypted.  You would have to get with the vendor to determine how to make the field legible , if it can be done at all.  It's possible this is data straight off the wire and that you would need the SSL certificate to process the data - not something one can do in SPL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sometimes one can tell by examining the events what changes need to be made.  In that case, go to Settings->Source types, select the appropriate sourcetype, and made the needed changes.

Other times it's not so easy.  One approach is to export some problematic events (raw) to a file.  Get them from the original source, if possible.  Then use the Add Data wizard to upload the file and experiment with props settings until you find the combination that works.  You then can update the app as above or put the settings into an app and upload it.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...