Updating Field Extraction Configuration for a Sourcetype Using Splunk Web

Overview

This section outlines how to modify field extraction parameters in the Netskope Add-on for Splunk to ensure accurate search time field extraction aligned with your custom field selections and order from Netskope Log Streaming.

Note: This operation requires the minimum version v4.4.0 of Netskope Add-on for Splunk.

1. Navigation Path in Splunk Search Head UI:

To access the configuration:

1. Log in to Splunk Web
2. Navigate to:
Settings → Fields → Fields Transformation
3. Select App as Netskope Add-on for Splunk (TA-NetSkopeAppForSplunk)
4. Select appropriate option:

• • For Alerts and Events data: extract_csv_fields_alertsevents

• • For Web transactions data: extract_csv_fields_webtxn

 
2. Updating Configuration

Step 1: Update Delimiters

• • Specify the delimiter used in the log data (default is comma)

Step 2: Update Field List

• • Provide the complete ordered list of field names from the Netskope UI (Navigate to Settings → Tools → Log Streaming)

• • Ensure alignment with the log structure

For more details on how to update field list refer to Netskope Documentation for the Log Streaming Fields Selection

NOTE: When selecting fields for log streaming, please ensure that the time field is placed in the first position. Time fields are x-cs-timestamp (For web transaction event)and timestamp (For Alerts and Events). Placing these fields first is necessary to ensure the event time is correctly extracted from the data.

Step 3: Save Configuration

• • Ensure the configurations are set appropriately, and keep the remaining configuration as shown in above example.

• • Click Save

 
3. Validation Steps

After saving the configuration:

• • Navigate to: Search & Reporting App

• • Run a validation query:
    index=<index_name> sourcetype=<sourcetype_name>

• • Verify:
    • • Fields are extracted correctly
    • • No field misalignment occurs
    • • Delimiter parsing is consistent