Splunk Search

Why are the data models intrusion and malware only working in the app search?

paola92
Explorer

Hi, I'm using Security enterprise but the datamodels intrusion and malware are not working but if I use the app search I see results.

Can anyone help me?alt text

I upload the result for the same search on different app.

0 Karma
1 Solution

jwelch_splunk
Splunk Employee
Splunk Employee

My guess would be that your app that is responsible for providing the eventtype/tags of ids and attack, does not meet the naming requirements of the App Imports regex in ES.

| rest /services/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local
| rename title AS master
| fields master, import
| mvexpand import
| join type=left import [| rest /services/apps/local splunk_server=local
| fields title, disabled | rename title AS import]

If you app is not listed here proceed to
a. renaming your app so the regex picks it up
b. modifying the regex so it can pick up your non-standard naming convention.

You can modify the regex in the UI under settings/data inputs/ App Imports or via conf file... Here is the default example... /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/default/inputs.conf

[app_imports_update://update_es]
app_regex         = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)
app_exclude_regex = sideview_utils
app_include_list  = Splunk_DA-ESS_PCICompliance
apps_to_update    = (SA-.*)|(Splunk_SA_.*)
# Leave this disabled, this input will be enabled in setup
disabled          = 1
interval          = 60

Hope this helps: Here is a link the docs on this:
https://docs.splunk.com/Documentation/ES/4.7.4/Install/ImportCustomApps

View solution in original post

jwelch_splunk
Splunk Employee
Splunk Employee

My guess would be that your app that is responsible for providing the eventtype/tags of ids and attack, does not meet the naming requirements of the App Imports regex in ES.

| rest /services/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local
| rename title AS master
| fields master, import
| mvexpand import
| join type=left import [| rest /services/apps/local splunk_server=local
| fields title, disabled | rename title AS import]

If you app is not listed here proceed to
a. renaming your app so the regex picks it up
b. modifying the regex so it can pick up your non-standard naming convention.

You can modify the regex in the UI under settings/data inputs/ App Imports or via conf file... Here is the default example... /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/default/inputs.conf

[app_imports_update://update_es]
app_regex         = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)
app_exclude_regex = sideview_utils
app_include_list  = Splunk_DA-ESS_PCICompliance
apps_to_update    = (SA-.*)|(Splunk_SA_.*)
# Leave this disabled, this input will be enabled in setup
disabled          = 1
interval          = 60

Hope this helps: Here is a link the docs on this:
https://docs.splunk.com/Documentation/ES/4.7.4/Install/ImportCustomApps

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!