Getting Data In

Why are Armis alerts logs not parsing correctly?

AL3Z
Builder

hi,

The Armis alerts in Splunk Cloud appear to be not being parsed correctly. We do have a technology addon for armis installed, how we can troubleshoot ??

Labels (4)
0 Karma

AL3Z
Builder

.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The packet field appears to encoded or encrypted.  You would have to get with the vendor to determine how to make the field legible , if it can be done at all.  It's possible this is data straight off the wire and that you would need the SSL certificate to process the data - not something one can do in SPL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sometimes one can tell by examining the events what changes need to be made.  In that case, go to Settings->Source types, select the appropriate sourcetype, and made the needed changes.

Other times it's not so easy.  One approach is to export some problematic events (raw) to a file.  Get them from the original source, if possible.  Then use the Add Data wizard to upload the file and experiment with props settings until you find the combination that works.  You then can update the app as above or put the settings into an app and upload it.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...