Knowledge Management

Correctly mapping data to CIM

vkor
New Member

Hi all!
I have got all-in-one standalone splunk installation, trying SplunkPCI app to work.
According to manual http://docs.splunk.com/Documentation/PCI/latest/Install/FirewallRuleActivity it is required to map data:
Note: Be sure the rule ID in the data is mapped to “rule”. This is not currently in the Common Information Model documentation.

The trouble is that after adding attribute rule in Settings->Data Model->Network Traffic with Eval Expression if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id) i dont see any changes:
communicate | table _time,host,sourcetype,action,dvc,rule,transport,src,src_port,dest,dest_port,vendor_product
field rule returns unknown

Tags (2)
0 Karma

fdi01
Motivator

Indeed your Eval expression if (isnull (rule) OR rule = "unknown" OR rule = "", "unknown_test" rule_id) command does not change the rule field in question because it creates an overcharged Expression field that takes the value "unknown_test" if (isnull (rule) OR rule = "unknown" OR rule = "" and values rule_id fields.
I think you should replace the name of the Expression field by rule if you want to view the change research like this

Eval rule if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id)
or

Eval rule= if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id)

| table _time,host,sourcetype,action,dvc,rule,transport,src,src_port,dest,dest_port,vendor_product
field rule returns unknown_test and certain values of the field rule_id

0 Karma
Get Updates on the Splunk Community!

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...