Splunk Enterprise Security

CEF parsing is not working

riqbal47010
Path Finder

we have one search head and one with Enterprise Security.

we have one index which named index=fireeye and logs are coming in CEF format.

on search head all the logs are being properly parsing but on ES, the logs are not being parsing.

0 Karma

ragedsparrow
SplunkTrust
SplunkTrust

This usually means that your configurations are not consistent across your search heads. Typically you would do most of your extractions at the indexing tier, but it appears that you are doing them at the Search layer.

You can try this running this on both Search Heads:

$SPLUNK_HOME$/bin/splunk btool props list <sourcetype>

$SPLUNK_HOME$ is where Splunk is installed (usually /opt/splunk on Linux). See if the output is the same on both search heads.

0 Karma

riqbal47010
Path Finder

I just removed the Fireeye Add-on from ES. and interesting all fields are being properly parsed as supposed to be. the logs are in CEF format.
can anyone explain what happened.

0 Karma

ragedsparrow
SplunkTrust
SplunkTrust

My best guess is a source/sourcetype override in the Fireye Add-on. You can use the btool command to do troubleshooting on your sourcetype and see what parsing is being applied to them.

0 Karma
Get Updates on the Splunk Community!

Cannot push config from deployer to search head cluster

Hello,I recently upgraded our deployer/deployment server from 8.1.6 to version 9.0 and when I try to push ...

Clear text password in command line

mogod command line argument having clear text password like "--sslPEMKeyPassword=password"how to avoid clear ...

Traffic logs from Splunk Add-on for Cisco Meraki

Recently deployed this add-on, but it doesn't seem to bring back Traffic or URL logs like we did when using ...