topic Re: Problem dropping events from fortinet in Splunk Enterprise

Problem dropping events from fortinet

tdepablo88 — Tue, 12 Jan 2021 18:22:27 GMT

Hi,

When i drop traffic events on a Heavy Forwarder (fgt_traffic) my stanza don't work, its weird because in another heavy forwarder i have the same configuration and its works, mi props.conf and transforms.conf are:

props.conf

# FILTRO Eventos Fortinet Traffic
[fgt_log]
TRANSFORMS-filtro = filtrado_fortinet_traffic

transforms.conf

[filtrado_fortinet_traffic]
SOURCE_KEY = _raw
REGEX = \stype\=\"traffic\"\s
DEST_KEY = queue
FORMAT = nullQueue

best regards.

Diego.

Re: Problem dropping events from fortinet

richgalloway — Tue, 12 Jan 2021 20:48:07 GMT

Did you install the props.conf and transforms.conf files on the FIRST HF that sees the data? Did you restart the HF after loading the files?

Re: Problem dropping events from fortinet

tdepablo88 — Wed, 13 Jan 2021 15:08:56 GMT

Hi,

Affirmative I put the same files on the first Heavy forwarder. yes I restart the HF after loading the files.

I'll close this question because the fortinets managers applied a filter on his appliances, to solve the issue I applied a filter because Fortinet didn't sent the corrects log files types.

thank you again Rich.

best regards.