Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: Custom add-on created , log are getting tagged...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
we created a custom add-on for crowdstrike and logs was in _json format . We did receptive tagging and used field alias to map with CIM . Now we can see the logs getting tagged and also can see field alias fields values however when we search in data model crowdstrike logs are not getting accelerated .
Request your help to troubleshoot the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For new data in new indexes to be reachable by a CIM Data Model, did you add the index in the CIM Configuration so Splunk starts to actually search for it?
If you have, another thing is, have you tried to do the DataModel base search and see if your tags and evenntypes are correct? Go to DataModels, select the one your are expecting that data to be matched against, grab the DataSet search and run it.
Let me know what is the scenario please
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For new data in new indexes to be reachable by a CIM Data Model, did you add the index in the CIM Configuration so Splunk starts to actually search for it?
If you have, another thing is, have you tried to do the DataModel base search and see if your tags and evenntypes are correct? Go to DataModels, select the one your are expecting that data to be matched against, grab the DataSet search and run it.
Let me know what is the scenario please
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks , I created the new index for new source and my CIM configuration were specfic to indexes .
however my one of the tagging not working rest all started working .
I saw in network traffic CIM config , tag "pci" only whitelisted ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you able to search data in data model without acceleration?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nope................
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you search root object search in search bar?
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
