Knowledge Management

Check Point App for Splunk: duplicated field values?

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I installed the Check Point App for Splunk and I found a strange behaviour:

at first the name is "Check Point App for Splunk" but the folder name is "TA-check-point-app-for-splunk" ,that's strange: it's an App or a TA?

But this isn't my problem:

installing this app I found that, for each event, there are some fields (date, time and rule_action) that are duplicated with the same value, in other words, for each event there is two times the same field and the same value (e.g. rule_action="allowed").

Has anyone encountered this problem?

Ciao and thanks,

Giuseppe

Labels (1)
Tags (2)
0 Karma

bharathkumarnec
Contributor

Hi @gcusello ,

Are you referring to the raw events that contains duplicates? If it is in the raw event, then it is nothing to do with the TA or Add-on?  If it is with the raw event itself, may be worth to check the source of the data that is sending the logs to splunk...

Only these three fields are having the duplicates or any other fields?

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bharathkumarnec,

no only these three fields.

Ciao.

Giuseppe

0 Karma

bharathkumarnec
Contributor

Hi @gcusello ,

I have noticed the same behaviour, but when i unistalled the app/addon still i see duplicated fields but they are in my raw event as well. 

Regards,

Bharath Kumar ASN

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

I've seen the behavior sometimes when you use `| extract reload=T` in the search but not sure if it's due to that or something else.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...