Splunk Enterprise Security : dest_ip field not showing in Splunk Incident Review

Applicability

Description

dest_ip is still not showing in Incident Review.
Additional field is not showing up in Incident Review dashboard even after configuring Incident Review : Attribute

Investigation

Found the following in props.conf : (below setting is masking dest_ip field) 

[stash]
FIELDALIAS-dest_ip = dest AS dest_ip

This is the reason the issue is happening. (To reproduce the issue  usethe props.conf above). 

 

Resolution

• Remove below setting $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/props.conf

[stash]FIELDALIAS-dest_ip = dest AS dest_ip

• Restart Splunk 
• Check the Incident Review Dashboard and see if you are able to see the "Destination IP Address" field. 

Run below command to test: 

| makeresults 
| eval user="skins", urgency="critical", query="xabcXYX", Record="A", src_ip="x.x.x.x", dest_ip=mvappend("x.x.x.x","x.x.x.x")
| sendalert notable

• Go to Incident Review dashboard and noticed "Destination IP Address" in the dest_ip field