topic Transforms.conf devid in Getting Data In

Transforms.conf devid

tel — Wed, 24 Apr 2024 09:29:01 GMT

Hello,

We are encountering a problem with the parsing on the fortigate add-on.
It does not recognize the devid of our equipment.
This fortigate having a serial number starting with FD, it was not taken into account by the regex.

regex: ^.+?devid=\"?F(?:G|W|\dK).+?(?:\s |\,|\,\s)type=\"?(traffic|utm|event|anomaly)

From the stanza: [force_sourcetype_fortigate]

We updated it on our side, but is this behavior normal?

Thanks in advance,
Best regards.

Re: Transforms.conf devid

deepakc — Wed, 24 Apr 2024 09:41:35 GMT

Sometimes you do encounter some extractions are not working as expected and sometimes logs change, so if encountered, then apply the fix to local config as you have done otherwise it will get overwritten with a new version of the TA. AS this is developed by FortiGate, there may be an email you can send them, so they can fix it for the next version, look for the details via the Splunk base or documentation.