Check Point App for Splunk: duplicated field values?

[gcusello]

Hi at all,

I installed the Check Point App for Splunk and I found a strange behaviour:

at first the name is "Check Point App for Splunk" but the folder name is "TA-check-point-app-for-splunk" ,that's strange: it's an App or a TA?

But this isn't my problem:

installing this app I found that, for each event, there are some fields (date, time and rule_action) that are duplicated with the same value, in other words, for each event there is two times the same field and the same value (e.g. rule_action="allowed").

Has anyone encountered this problem?

Ciao and thanks,

Giuseppe

[bharathkumarnec]

Hi @gcusello ,

Are you referring to the raw events that contains duplicates? If it is in the raw event, then it is nothing to do with the TA or Add-on?  If it is with the raw event itself, may be worth to check the source of the data that is sending the logs to splunk...

Only these three fields are having the duplicates or any other fields?

[gcusello]

Hi @bharathkumarnec,

no only these three fields.

Ciao.

Giuseppe

[bharathkumarnec]

Hi @gcusello ,

I have noticed the same behaviour, but when i unistalled the app/addon still i see duplicated fields but they are in my raw event as well. 

Regards,

Bharath Kumar ASN

[VatsalJagani]

I've seen the behavior sometimes when you use `| extract reload=T` in the search but not sure if it's due to that or something else.