XMA: How to view contents of data sent to Splunk
The following SQL Query is all the customer will need to run in order to see the contents of the data sent to Splunk.
Set list_count 0;
select alertedgmt, message FROM SYSLOGQ
where cast(alertedgmt as date) = date 'yyyy-mm-dd'
BROWSE ACCESS;
detail alertedgmt as a16,message as c1000.59;
list all;alertedgmt : time the message is accepted by the SIEM
message: the content of the message sent to the SIEM
Related Articles
XMA: Can XMA movers send data off-box to a SIEM?
Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...
XMA Data Substitution Tokens represent space and an empty string
Information about the Data Substitution Tokens on the ALERTSTRING keyword
XMA: How to modify XMA Log Adapter filters to send the same data to two different SIEMs simultaneously
** Please read before beginning this procedure ** 1.This procedure assumes that the Log Adapter (LAF) filters have already been installed. If they have not been installed, this procedure cannot be performed. If this is the case, please see the ...
XMA: How to see messages that are sent by the SLSENDER using SQL queries.
To get the host names and port numbers with failing messages, and number of messages waiting in queue to be sent: SELECT TARGET_HOST, TARGET_PORT, COUNT(*) FROM =XMA_SYSLOGQ WHERE ALERTEDGMT = TIMESTAMP "1970-01-01:00:00:00.000000" GROUP BY ...
XMA: Data selection criteria to avoid sending $0 messages to a target SIEM
The FILTER Data selection criteria for the ACTIONTYPE SYSLOGQ filter definition to avoid sending EMS messages from the collector $0 to the target SIEM are as follows: MOVER_BEGIN MOVER_SELECT_BEGIN PRODUCT = EMS MOVER_SELECT_END MOVER_END DATA_BEGIN ...