topic Re: LEEF format results in 1 liner entries into Splunk in Getting Data In

LEEF format results in 1 liner entries into Splunk

tan_junyuan — Tue, 22 Oct 2019 09:23:28 GMT

For some reason, 1 liner entries are send to my splunk, after incapsula logs shifted to LEEF format. Initially, we were using CEF format.

sourcetype:incapsula
1 liner log entries look like this:
startTime:xxxxx

startTime:xxxx

endTime:xxxxxx

Vendor is unable to change on their end, anything we can do the Splunk side, to make it such that the entries can be recognized by Splunk?

Re: LEEF format results in 1 liner entries into Splunk

richgalloway — Tue, 22 Oct 2019 14:46:06 GMT

You need to change your props.conf and/or transforms.conf settings. There are a few Incapsula apps at apps.splunk.com that may do the job for you. See https://splunkbase.splunk.com/app/4690 for one of them.

Re: LEEF format results in 1 liner entries into Splunk

tan_junyuan — Wed, 23 Oct 2019 05:35:57 GMT

what do you mean by changing props.conf and transforms.conf, how does this LEEF format affect this? I can go props.conf and transforms.conf, there is a property that I can define as LEEF format?

Re: LEEF format results in 1 liner entries into Splunk

tan_junyuan — Wed, 23 Oct 2019 05:36:39 GMT

yes, incapsula apps is already installed. Previously, CEF format works fine.

Re: LEEF format results in 1 liner entries into Splunk

richgalloway — Wed, 23 Oct 2019 14:40:15 GMT

There is no single property for LEEF or CEF. You must define combinations of the supported properties so Splunk knows how to process your data.
I'm not familiar with the Incapsula apps. Do they have options for LEEF?