Getting Data In

Why are Armis alerts logs not parsing correctly?

AL3Z
Builder

hi,

The Armis alerts in Splunk Cloud appear to be not being parsed correctly. We do have a technology addon for armis installed, how we can troubleshoot ??

Labels (4)
0 Karma

AL3Z
Builder

.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The packet field appears to encoded or encrypted.  You would have to get with the vendor to determine how to make the field legible , if it can be done at all.  It's possible this is data straight off the wire and that you would need the SSL certificate to process the data - not something one can do in SPL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sometimes one can tell by examining the events what changes need to be made.  In that case, go to Settings->Source types, select the appropriate sourcetype, and made the needed changes.

Other times it's not so easy.  One approach is to export some problematic events (raw) to a file.  Get them from the original source, if possible.  Then use the Add Data wizard to upload the file and experiment with props settings until you find the combination that works.  You then can update the app as above or put the settings into an app and upload it.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...