Knowledge Management

Correctly mapping data to CIM

New Member

Hi all!
I have got all-in-one standalone splunk installation, trying SplunkPCI app to work.
According to manual http://docs.splunk.com/Documentation/PCI/latest/Install/FirewallRuleActivity it is required to map data:
Note: Be sure the rule ID in the data is mapped to “rule”. This is not currently in the Common Information Model documentation.

The trouble is that after adding attribute rule in Settings->Data Model->Network Traffic with Eval Expression if(isnull(rule) OR rule="unknown" OR rule="","unknowntest",ruleid) i dont see any changes:
communicate | table time,host,sourcetype,action,dvc,rule,transport,src,srcport,dest,destport,vendorproduct
field rule returns unknown

Tags (2)
0 Karma

Motivator

Indeed your Eval expression if (isnull (rule) OR rule = "unknown" OR rule = "", "unknowntest" ruleid) command does not change the rule field in question because it creates an overcharged Expression field that takes the value "unknowntest" if (isnull (rule) OR rule = "unknown" OR rule = "" and values ruleid fields.
I think you should replace the name of the Expression field by rule if you want to view the change research like this

Eval rule if(isnull(rule) OR rule="unknown" OR rule="","unknowntest",ruleid)
or

Eval rule= if(isnull(rule) OR rule="unknown" OR rule="","unknowntest",ruleid)

| table time,host,sourcetype,action,dvc,rule,transport,src,srcport,dest,destport,vendorproduct
field rule returns unknowntest and certain values of the field ruleid

0 Karma