Hello, We are using the Splunk app for checkpoint to ingest checkpoint logs via a heavy forwarder. The host is always reported as the management server and we want to override that with the IPs of the actual firewalls. I created the following files in the local folders on the heavy forwarder: props.conf [cp_log] TRANSFORMS-host_override = host_override transforms.conf [host_override] REGEX = origin=([^|]+) DEST_KEY = MetaData:Host FORMAT = host::$1 Restarted Splunk but there's no change, the host value remains the same. btool shows that the local props and transforms files are applied. I can even see the Field transformation on the heavy forwarder UI. I've also checked that the regex works fine and extracts the correct values. Any ideas? Thank you! ... View more

Hello, Could you please let me know if this add-on is working with Bitbucket Cloud as well? Or just with BItbucket Server? Regards, ... View more

Hi, I am using a 3rd party tool to get information about different indicators of compromise (eg: domains). I am getting data from that tool through a rest API. What I'm trying to do is to enrich the events from our proxy server, with the information provided by this API. index=proxy category="Malware" | join domain type=left [| rest splunk_server=local /services/3rdpartytool/lookup_domain/$domain$ fields="entity,risk" | rename entity.name as domain] | table domain, src_ip, risk.score Where it fails is when passing the $domain$ variable to the rest subsearch: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/3rdpartytool/lookup_domain/$domain$ I tried the other way around, with the same result: | rest splunk_server=local /services/3rdpartytool/lookup_domain/$domain$ fields="entity,risk" | rename entity.name as domain | join domain [search index=proxy category="Malware"] | table table domain, src_ip, risk.score domain and src_ip are returned by the index=proxy... search while risk.score is returned by the rest search. So, the way I want this to work is: if a user accessed a domain categorized as Malware by the proxy server then attach the risk.score for the respective domain provided by the 3rd party tool Any idea on how to achieve this? Thank you. ... View more