Correctly mapping data to CIM

[vkor]

Hi all!
I have got all-in-one standalone splunk installation, trying SplunkPCI app to work.
According to manual http://docs.splunk.com/Documentation/PCI/latest/Install/FirewallRuleActivity it is required to map data:
Note: Be sure the rule ID in the data is mapped to “rule”. This is not currently in the Common Information Model documentation.

The trouble is that after adding attribute rule in Settings->Data Model->Network Traffic with Eval Expression if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id) i dont see any changes:
communicate | table _time,host,sourcetype,action,dvc,rule,transport,src,src_port,dest,dest_port,vendor_product
field rule returns unknown

[fdi01]

Indeed your Eval expression if (isnull (rule) OR rule = "unknown" OR rule = "", "unknown_test" rule_id) command does not change the rule field in question because it creates an overcharged Expression field that takes the value "unknown_test" if (isnull (rule) OR rule = "unknown" OR rule = "" and values rule_id fields.
I think you should replace the name of the Expression field by rule if you want to view the change research like this

Eval rule if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id)
or

Eval rule= if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id)

| table _time,host,sourcetype,action,dvc,rule,transport,src,src_port,dest,dest_port,vendor_product
field rule returns unknown_test and certain values of the field rule_id