NetMotion Mobility Add-on for Splunk

Overview

Details

Provides CIM field extractions and other useful field extractions, as well as sourcetype transforming based on the event for your NetMotion Mobility syslog data.

+ Currently Supports:
++ NetMotion Mobility Server Event Log (nmservic.exe)
+++https://help.netmotionsoftware.com/support/docs/MobilityXG/1130/help/mobilityhelp.htm#page/Mobility%2520Server%2Fmanage.07.014.html%23
+ Built for Splunk Enterprise 7.x or higher
+ CIM Compliant (CIM 4.15 or higher)
+ Ready for Enterprise Security

Add-on Homepage: https://apps.splunk.com/apps/id/TA_netmotion_mobility_syslog

Author: Hurricane Labs

Version: 1.0.0

Description

Provides CIM field extractions and other useful field extractions, as well as sourcetype transforming based on the event.

Currently Supports:
- NetMotion Mobility Server Event Log (nmservic.exe)
  - https://help.netmotionsoftware.com/support/docs/MobilityXG/1130/help/mobilityhelp.htm#page/Mobility%2520Server%2Fmanage.07.014.html%23
Built for Splunk Enterprise 7.x or higher
CIM Compliant (CIM 4.15 or higher)
Ready for Enterprise Security

Constraints / Requirements

Requires the use of the Syslog as described here:
- https://help.netmotionsoftware.com/support/docs/MobilityXG/1130/help/mobilityhelp.htm#page/Mobility%2520Server%2Fmanage.07.016.html%23
Requires that you onboard data with the sourcetype "netmotion:mobility" for it to be transformed and receive the appropriate fields.

INSTALLATION AND CONFIGURATION

Installation Instructions

This TA should be installed on your Search Heads and the first Splunk Enterprise instance that touches the data (typically Heavy Forwarder(s) or Indexer(s))
Ensure Splunk Enterprise has restarted on the parsing instance before ingesting data
Data ingestion can be accomplished in many ways. Best practice would be to use a syslog solution that writes out to a file on disk that you monitor with a Splunk file monitor inputs.conf OR use SC4S. You can use the built in Splunk TCP/UDP listener, but this is highly discouraged.
Once TA installation and data ingestion have been completed, search your data with index=X sourcetype=netmotion:mobility:*
- You should see many different sourcetypes appear. If you see netmotion:mobility as a sourcetype, then the TA was not installed on the parsing tier correctly or your data is formatted differently than expected (and will require a custom fix in local/transforms.conf).

New features

Fixed issues

Known issues

Third-party software attributions

DEV SUPPORT

Contact: splunk-app@hurricanelabs.com

Release Notes

Version 1.0.0

Sept. 22, 2021

Installs

Downloads

Share Subscribe

Version

Built by

Hurricane Labs

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

Compatibility

Products: Splunk Enterprise, Splunk Cloud

Splunk Versions: 7.2, 7.3, 8.0, 8.1, 8.2

Platform: Platform Independent

CIM Versions: 4.x

Licensing

End User License Agreement for Third-Party Content

Category & Contents

Categories: IT Operations, Security, Fraud & Compliance

App Type: Add-on

Subscribe Share

My Account

Support & Services