Splunk Search

Why are the data models intrusion and malware only working in the app search?

paola92
Explorer

Hi, I'm using Security enterprise but the datamodels intrusion and malware are not working but if I use the app search I see results.

Can anyone help me?alt text

I upload the result for the same search on different app.

0 Karma
1 Solution

jwelch_splunk
Splunk Employee
Splunk Employee

My guess would be that your app that is responsible for providing the eventtype/tags of ids and attack, does not meet the naming requirements of the App Imports regex in ES.

| rest /services/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local
| rename title AS master
| fields master, import
| mvexpand import
| join type=left import [| rest /services/apps/local splunk_server=local
| fields title, disabled | rename title AS import]

If you app is not listed here proceed to
a. renaming your app so the regex picks it up
b. modifying the regex so it can pick up your non-standard naming convention.

You can modify the regex in the UI under settings/data inputs/ App Imports or via conf file... Here is the default example... /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/default/inputs.conf

[app_imports_update://update_es]
app_regex         = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)
app_exclude_regex = sideview_utils
app_include_list  = Splunk_DA-ESS_PCICompliance
apps_to_update    = (SA-.*)|(Splunk_SA_.*)
# Leave this disabled, this input will be enabled in setup
disabled          = 1
interval          = 60

Hope this helps: Here is a link the docs on this:
https://docs.splunk.com/Documentation/ES/4.7.4/Install/ImportCustomApps

View solution in original post

jwelch_splunk
Splunk Employee
Splunk Employee

My guess would be that your app that is responsible for providing the eventtype/tags of ids and attack, does not meet the naming requirements of the App Imports regex in ES.

| rest /services/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local
| rename title AS master
| fields master, import
| mvexpand import
| join type=left import [| rest /services/apps/local splunk_server=local
| fields title, disabled | rename title AS import]

If you app is not listed here proceed to
a. renaming your app so the regex picks it up
b. modifying the regex so it can pick up your non-standard naming convention.

You can modify the regex in the UI under settings/data inputs/ App Imports or via conf file... Here is the default example... /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/default/inputs.conf

[app_imports_update://update_es]
app_regex         = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)
app_exclude_regex = sideview_utils
app_include_list  = Splunk_DA-ESS_PCICompliance
apps_to_update    = (SA-.*)|(Splunk_SA_.*)
# Leave this disabled, this input will be enabled in setup
disabled          = 1
interval          = 60

Hope this helps: Here is a link the docs on this:
https://docs.splunk.com/Documentation/ES/4.7.4/Install/ImportCustomApps

Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...