Getting Data In

Cisco eNcore eStreamer fields value changed (5.4 -> 6.1)

golsida
Explorer

HI, splunker.

I'm testing two different versions of the estreamer app. (FMC : 5.4, 6.1 / Splunk App : 1629, 3662)
I found two problems with the encore version. (3662) and rec_type=400.

1) src_ip_country is okay (string), but dest_ip_country is number.
2) In the FMC 5.4 and Splunk App 1629, the fw_rule value is displayed as a letter,
but in the FMC 6.1 and Splunk App 3662 version it is displayed as a number.

I wonder if this is a bug or is it intended.
If it is a bug, would you tell me which python source to modify?

0 Karma

aakwah
Builder

You need to check field extraction for the affected sourcetype in props.conf and transforms.conf in the app, or you can send sample from affected log line and the application url on splunkbase to check.

0 Karma

golsida
Explorer

@aakwah

I think props.conf and transforms.conf does not matter.
Because, python source code did not define some field.

For example, $SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/splunk.py file does not define DESTINATION_IP_COUNTRY, destinationCountry
and $SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/estreamer/metadata/view.py file does not define DESTINATION_IP_COUNTRY.

0 Karma

aakwah
Builder

I didn't check the app yet, but for checkpoint app for example the scripted input role is to retrieve the data from the source then field extraction is the responsibility of searchheads via transforms and props.conf.

Once you have the data into the index you can extract the fields the way you like.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...