https://community.splunk.com/t5/Getting-Data-In/Best-syslog-format-for-McAfee-Sidewinder-logs-forwarded-to/m-p/99599#M20840 <P>What is the best practice for formating syslogs forwarded to Splunk from a McAfee Sidewinder firewall? The choices are: W3C Extend Log Format (HTTP), Extensible Markup Language (XML), Binary or RAW (bin), American Standard Code of Information Interchange (ascii), or Verbose American Standard Code of Information Interchange(vascii). Excluded are vendor specific formats: Sidewinder Export Format (SEF) and WebTrends Extended Logging Format (WELF). Justification for choice?</P> Tue, 23 Oct 2012 19:20:07 GMT johnwsrns 2012-10-23T19:20:07Z https://community.splunk.com/t5/Getting-Data-In/Best-syslog-format-for-McAfee-Sidewinder-logs-forwarded-to/m-p/99599#M20840 <P>What is the best practice for formating syslogs forwarded to Splunk from a McAfee Sidewinder firewall? The choices are: W3C Extend Log Format (HTTP), Extensible Markup Language (XML), Binary or RAW (bin), American Standard Code of Information Interchange (ascii), or Verbose American Standard Code of Information Interchange(vascii). Excluded are vendor specific formats: Sidewinder Export Format (SEF) and WebTrends Extended Logging Format (WELF). Justification for choice?</P> Tue, 23 Oct 2012 19:20:07 GMT https://community.splunk.com/t5/Getting-Data-In/Best-syslog-format-for-McAfee-Sidewinder-logs-forwarded-to/m-p/99599#M20840 johnwsrns 2012-10-23T19:20:07Z https://community.splunk.com/t5/Getting-Data-In/Best-syslog-format-for-McAfee-Sidewinder-logs-forwarded-to/m-p/99600#M20841 <P>ASCII or w3c, or possibly XML. It would of course be probably more relevant if the formats had different data, or if there were more or less structure or info in one than the other. I don't know what vascii is, but if it's just ascii with more info, maybe that's better.</P> Tue, 23 Oct 2012 19:38:39 GMT https://community.splunk.com/t5/Getting-Data-In/Best-syslog-format-for-McAfee-Sidewinder-logs-forwarded-to/m-p/99600#M20841 gkanapathy 2012-10-23T19:38:39Z