Knowledge Management

Check Point App for Splunk: duplicated field values?

gcusello
Esteemed Legend

Hi at all,

I installed the Check Point App for Splunk and I found a strange behaviour:

at first the name is "Check Point App for Splunk" but the folder name is "TA-check-point-app-for-splunk" ,that's strange: it's an App or a TA?

But this isn't my problem:

installing this app I found that, for each event, there are some fields (date, time and rule_action) that are duplicated with the same value, in other words, for each event there is two times the same field and the same value (e.g. rule_action="allowed").

Has anyone encountered this problem?

Ciao and thanks,

Giuseppe

Labels (1)
Tags (2)
0 Karma

bharathkumarnec
Communicator

Hi @gcusello ,

Are you referring to the raw events that contains duplicates? If it is in the raw event, then it is nothing to do with the TA or Add-on?  If it is with the raw event itself, may be worth to check the source of the data that is sending the logs to splunk...

Only these three fields are having the duplicates or any other fields?

 

0 Karma

gcusello
Esteemed Legend

Hi @bharathkumarnec,

no only these three fields.

Ciao.

Giuseppe

0 Karma

bharathkumarnec
Communicator

Hi @gcusello ,

I have noticed the same behaviour, but when i unistalled the app/addon still i see duplicated fields but they are in my raw event as well. 

Regards,

Bharath Kumar ASN

0 Karma

VatsalJagani
Super Champion

I've seen the behavior sometimes when you use `| extract reload=T` in the search but not sure if it's due to that or something else.

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...