https://community.splunk.com/t5/Getting-Data-In/Parsing-pfsense-2-3-4-firewall-logs/m-p/420057#M73991 <P>I am trying to parse pfsense 2.3.4 firewall logs in splunk, but I am not able to extract the fields properly.</P> <P>I tried changing the props and transforms config files as stated here: <A href="http://blog.basementpctech.com/2012/02/splunk-and-pfsense-what-pair.html">http://blog.basementpctech.com/2012/02/splunk-and-pfsense-what-pair.html</A></P> <P>But its not working for me. Can anyone help regarding this.</P> <P>Sample logs:</P> <P>filterlog: 7,16777216,,1000000105,em2_vlan11,match,block,in,6,0x00,0x00000,1,UDP,17,982,fe90::125:36ff:f0fe:3a69,f062::c,3702,3702,982<BR /> host =10.10.4.3 source =udp:514 sourcetype =syslog</P> Mon, 28 May 2018 10:09:13 GMT jawadak 2018-05-28T10:09:13Z https://community.splunk.com/t5/Getting-Data-In/Parsing-pfsense-2-3-4-firewall-logs/m-p/420057#M73991 <P>I am trying to parse pfsense 2.3.4 firewall logs in splunk, but I am not able to extract the fields properly.</P> <P>I tried changing the props and transforms config files as stated here: <A href="http://blog.basementpctech.com/2012/02/splunk-and-pfsense-what-pair.html">http://blog.basementpctech.com/2012/02/splunk-and-pfsense-what-pair.html</A></P> <P>But its not working for me. Can anyone help regarding this.</P> <P>Sample logs:</P> <P>filterlog: 7,16777216,,1000000105,em2_vlan11,match,block,in,6,0x00,0x00000,1,UDP,17,982,fe90::125:36ff:f0fe:3a69,f062::c,3702,3702,982<BR /> host =10.10.4.3 source =udp:514 sourcetype =syslog</P> Mon, 28 May 2018 10:09:13 GMT https://community.splunk.com/t5/Getting-Data-In/Parsing-pfsense-2-3-4-firewall-logs/m-p/420057#M73991 jawadak 2018-05-28T10:09:13Z