topic Re: Juniper VPN SA 2500 Source type in Security

Juniper VPN SA 2500 Source type

ifsuser — Tue, 20 Mar 2012 12:16:17 GMT

Which source type should i use when receiving data from my Juniper SA2500 box using UDP

thanks

MarioM — Wed, 21 Mar 2012 11:08:43 GMT

if you are using this app splunk-for-juniper-sa then you should use juniper_sa_log but it should automatically as per props.conf:

[source::udp:514]
TRANSFORMS-sasourcetype= sa_sourcetyper

and transforms.conf:

[sa_sourcetyper]
DEST_KEY = MetaData:Sourcetype
REGEX = Juniper\:\s[^\s]+\s[^\s]+\s-\sive
FORMAT = sourcetype::juniper_sa_log

yesyes3 — Wed, 06 Feb 2013 11:18:14 GMT

Thanks, started to work after adding those lines to props.conf. Also had to modify regex to Juniper:\s[^\s]+\s[^\s]+\s-\s