https://community.splunk.com/t5/Getting-Data-In/Checkpoint-log-exporter-props/m-p/561132#M92703 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/205414">@shivarpith</a>&nbsp;</P><P>Can you share the sample events and how your props conf written?</P><P>How are you collecting these checkpoint firewall logs?</P><P>&nbsp;</P> Wed, 28 Jul 2021 01:59:13 GMT venkatasri 2021-07-28T01:59:13Z https://community.splunk.com/t5/Getting-Data-In/Checkpoint-log-exporter-props/m-p/561021#M92690 <P>Hi,</P><P>We have recently migrated from LEA to checkpoint log exporter facility to collect Checkpoint firewall logs in CEF format.</P><P>Even after trying multiple props configuration, we still observe events breaking at irregular intervals.</P><P>Some events parse correctly at the start and end of the event and some in between or abruptly.</P><P>we even tried the splunk add-on -&nbsp;<A href="https://splunkbase.splunk.com/app/4180/" target="_blank" rel="noopener">https://splunkbase.splunk.com/app/4180/</A></P><P>Does anyone have a working props?</P> Tue, 27 Jul 2021 13:24:27 GMT https://community.splunk.com/t5/Getting-Data-In/Checkpoint-log-exporter-props/m-p/561021#M92690 shivarpith 2021-07-27T13:24:27Z https://community.splunk.com/t5/Getting-Data-In/Checkpoint-log-exporter-props/m-p/561132#M92703 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/205414">@shivarpith</a>&nbsp;</P><P>Can you share the sample events and how your props conf written?</P><P>How are you collecting these checkpoint firewall logs?</P><P>&nbsp;</P> Wed, 28 Jul 2021 01:59:13 GMT https://community.splunk.com/t5/Getting-Data-In/Checkpoint-log-exporter-props/m-p/561132#M92703 venkatasri 2021-07-28T01:59:13Z