topic Checkpoint events are not being parsed properly in Getting Data In

Checkpoint events are not being parsed properly

adrifesa95 — Thu, 06 Jun 2024 10:14:11 GMT

Hello,

We are ingesting Checkpoint logs through an Edge Processor to our SCP. We have deployed Splunk Add-on for Check Point Log Exporter in SCP but events are not parsing properly. I show you in a screenshot:

We only can use these fields, related to the EP

Could someone help us?

Thank's in advance

Re: Checkpoint events are not being parsed properly

adrifesa95 — Mon, 10 Jun 2024 08:54:40 GMT

any help?

Re: Checkpoint events are not being parsed properly

nyc_jason — Wed, 04 Sep 2024 12:17:36 GMT

Hello adrifesa95. Are you using the Splunk Add-on for Check Point Log Exporter, or the older Splunk Add-on for Check Point OPSEC LEA? If the newer one, there is a section on the docs referring to troubleshooting when its not parsing due to depth limit and how to increase it...

https://docs.splunk.com/Documentation/AddOns/released/CheckPointLogExporter/Troubleshoot