Why are Armis alerts logs not parsing correctly?

[smith_]

hi,

The Armis alerts in Splunk Cloud appear to be not being parsed correctly. We do have a technology addon for armis installed, how we can troubleshoot ??

[smith_]

.

[richgalloway]

The packet field appears to encoded or encrypted.  You would have to get with the vendor to determine how to make the field legible , if it can be done at all.  It's possible this is data straight off the wire and that you would need the SSL certificate to process the data - not something one can do in SPL.

[richgalloway]

Sometimes one can tell by examining the events what changes need to be made.  In that case, go to Settings->Source types, select the appropriate sourcetype, and made the needed changes.

Other times it's not so easy.  One approach is to export some problematic events (raw) to a file.  Get them from the original source, if possible.  Then use the Add Data wizard to upload the file and experiment with props settings until you find the combination that works.  You then can update the app as above or put the settings into an app and upload it.