topic Re: Filtering Fortinet logs in splunk in Security

Filtering Fortinet logs in splunk

islam — Fri, 04 Jun 2021 03:55:40 GMT

Hi,

how can we filter fortinet logs from splunk like informational data type, also can i filter fori logs comming from specific ip like x.x.x.x

Re: Filtering Fortinet logs in splunk

venkatasri — Thu, 10 Jun 2021 23:56:20 GMT

Hi @islam

What exactly mean by filter, filter them at search time or while ingesting?

Re: Filtering Fortinet logs in splunk

islam — Fri, 11 Jun 2021 00:21:23 GMT

@venkatasri

i need to filter them while ingesting, i don't need to index specific data types like informational or data from specific IP

Re: Filtering Fortinet logs in splunk

venkatasri — Fri, 11 Jun 2021 00:46:48 GMT

@islam do you have sample event where to find informational data type inside _raw and where ip address that you want to filter appear as host field/ in _raw event. you can send them nullQueue by using rex pattern.