Knowledge Management

Correctly mapping data to CIM

vkor
New Member

Hi all!
I have got all-in-one standalone splunk installation, trying SplunkPCI app to work.
According to manual http://docs.splunk.com/Documentation/PCI/latest/Install/FirewallRuleActivity it is required to map data:
Note: Be sure the rule ID in the data is mapped to “rule”. This is not currently in the Common Information Model documentation.

The trouble is that after adding attribute rule in Settings->Data Model->Network Traffic with Eval Expression if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id) i dont see any changes:
communicate | table _time,host,sourcetype,action,dvc,rule,transport,src,src_port,dest,dest_port,vendor_product
field rule returns unknown

Tags (2)
0 Karma

fdi01
Motivator

Indeed your Eval expression if (isnull (rule) OR rule = "unknown" OR rule = "", "unknown_test" rule_id) command does not change the rule field in question because it creates an overcharged Expression field that takes the value "unknown_test" if (isnull (rule) OR rule = "unknown" OR rule = "" and values rule_id fields.
I think you should replace the name of the Expression field by rule if you want to view the change research like this

Eval rule if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id)
or

Eval rule= if(isnull(rule) OR rule="unknown" OR rule="","unknown_test",rule_id)

| table _time,host,sourcetype,action,dvc,rule,transport,src,src_port,dest,dest_port,vendor_product
field rule returns unknown_test and certain values of the field rule_id

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...