Checkpoint Firewall Log Timestamps

cfairbairn — Tue, 11 Sep 2018 00:19:31 GMT

I'm running Splunk Light 7.1.3 on a Windows 2012 R2 server. I have some text logs from Checkpoint firewalls - unfortunately I don't have direct access to the firewall appliances themselves.

An example of line data that I'm working with is:

"" "5Sep2018" "23:58:59" "" "" "Log" "Drop" "<#>" "" "" "" "" "" "" "" "" "" "t" "" ""

I'm using the WebGUI data import tool to import the text files. I can't seem to get Splunk to recognise the timestamps.

I've used the following timestamp format:

%e%b%Y %k:%M:%S

And a couple of different variations (%d, %H) etc. No luck.

I get the error "Could not use strptime to parse timestamp..."

Any idea on what I'm doing wrong?

Re: Checkpoint Firewall Log Timestamps

HiroshiSatoh — Tue, 11 Sep 2018 01:28:33 GMT

I got it in this format.

%d%b%Y %H:%M:%S

Re: Checkpoint Firewall Log Timestamps

cfairbairn — Tue, 11 Sep 2018 03:49:29 GMT

Thanks. I have tried that time format also without luck.

topic Re: Checkpoint Firewall Log Timestamps in Splunk Enterprise

Checkpoint Firewall Log Timestamps

Re: Checkpoint Firewall Log Timestamps

Re: Checkpoint Firewall Log Timestamps