Getting Data In

Splunk App for Check Point

gstefancyk
Path Finder

I am currently pulling logs from my Check Point Management station successfully and can search on them with no issues. I am trying to get the Splunk app for Check Point to display data and am looking for some clarification on what indexes need to be created?

Currently I have all Check Point non-audit logs going into the default index. Can anyone clarify for me what index the Splunk App for Check Point looks at and what index or indexes I need to create?

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

The Splunk app for Checkpoint seems to use checkpoint_indexas a macro behind most of the searches. That macro is simple and says index=checkpoint, so your data needs to be indexed in the index "checkpoint". (You could - though I don't recommend it - change that macro to point to main. More explanation can be given, but mostly it's just you shouldn't use main.)

Speaking of which, did you set up the Splunk add-on for Check Point OPSEC LEA as the docs mention?

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

The Splunk app for Checkpoint seems to use checkpoint_indexas a macro behind most of the searches. That macro is simple and says index=checkpoint, so your data needs to be indexed in the index "checkpoint". (You could - though I don't recommend it - change that macro to point to main. More explanation can be given, but mostly it's just you shouldn't use main.)

Speaking of which, did you set up the Splunk add-on for Check Point OPSEC LEA as the docs mention?

0 Karma

gstefancyk
Path Finder

Thanks rich7177.

I must have missed that little section at the bottom of the App details page that says log everything to "checkpoint". I have configured the opsec lea add on to log to index checkpoint and data is now populating the Splunk App for Check Point.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...