topic Re: Field extraction via props/transforms for juniper logs in splunk cloud in Knowledge Management

Field extraction via props/transforms for juniper logs in splunk cloud?

sekhar463 — Wed, 15 Feb 2023 15:39:13 GMT

hai team,

we are using splunk cloud and one prem HF

we are getting juniper logs as syslogs and we are using Splunk_TA_juniper in splunk cloud

how to do field attraction from my end

Re: Field extraction via props/transforms for juniper logs in splunk cloud

gcusello — Wed, 15 Feb 2023 09:22:24 GMT

Hi @sekhar463,

if syslogs from Juniper arrive to Splunk Cloud passing through one or more HFs, you have to install the Splunk_TA_juniper also on the HFs because data are coocked on the first Full Splunk instance (HFs) where they are passing trough.

Ciao.

Giuseppe

Re: Field extraction via props/transforms for juniper logs in splunk cloud

sekhar463 — Wed, 15 Feb 2023 09:27:09 GMT

Thanks.

once installed any config need to do ? will it automatically take

Re: Field extraction via props/transforms for juniper logs in splunk cloud

gcusello — Wed, 15 Feb 2023 09:29:13 GMT

Hi @sekhar463,

I suppose that you already configured the input from Juniper.

If not, follow the instructions at https://docs.splunk.com/Documentation/AddOns/latest/juniper/About?_ga=2.107177089.2041590115.1672646338-1358809174.1667771201&_gl=1*jhzgs1*_ga*MTM1ODgwOTE3NC4xNjY3NzcxMjAx*_ga_5EPM2P39FV*MTY3NjQ1MTg0MS41MDEuMS4xNjc2NDUzMzIxLjU0LjAuMA..

Ciao.

Giuseppe

Re: Field extraction via props/transforms for juniper logs in splunk cloud

sekhar463 — Wed, 15 Feb 2023 09:55:14 GMT

we already configured the inputs for syslogs

but if we configured again for the input using ADDON is it leads duplicate logs

and if we install TA in HF what is the config we need to do for extraction

does it required inputs or props

Re: Field extraction via props/transforms for juniper logs in splunk cloud

gcusello — Wed, 15 Feb 2023 10:07:36 GMT

Hi @sekhar463,

I suppose that you are ingesting logs from Juniper using an HF.

Is the HF where you enabled inputs the same that sends logs to Splunk Cloud or there's another intermediate HF?

On the first HF you have to use the Splunk_TA_for_Juniper enabling the wanted inputs, don't use another app or inputs outside the add-on.

In this way you correctly ingest logs, that are correctly parsed by the add-on and sent to Splunk Splunk.

On Splunk Cloud you have to install the same TA for the search time configurations.

Ciao.

Giuseppe

Re: Field extraction via props/transforms for juniper logs in splunk cloud

PickleRick — Wed, 15 Feb 2023 10:37:58 GMT

To be precise, the data is _parsed_ on the HFs, not cooked. Data is cooked on UFs and sent cooked to HFs/indexers. It is parsed on HF and sent to indexers (hence the advice to avoid using HF unless absolutely needed - parsed data is much bigger in volume than cooked data).

Re: Field extraction via props/transforms for juniper logs in splunk cloud

sekhar463 — Wed, 15 Feb 2023 10:59:52 GMT

yes we have multiple HF "s getting syslogs to splunk cloud for juniper.

so how we can install ADDON and we need to disable syslog inputs

Re: Field extraction via props/transforms for juniper logs in splunk cloud

gcusello — Wed, 15 Feb 2023 11:11:52 GMT

Hi @sekhar463,

you don't need to disable all syslogs, only the ones from Juniper,

at the same time the Splunk_TA_Juniper must be installed only in HFs used to ingest logs from Juniper not in all HFs.

Ciao.

Giuseppe

Re: Field extraction via props/transforms for juniper logs in splunk cloud

sekhar463 — Wed, 15 Feb 2023 12:12:06 GMT

okay so we can disable syslog input and once installed need to create new inputs in TA ADDON right

Re: Field extraction via props/transforms for juniper logs in splunk cloud

gcusello — Wed, 15 Feb 2023 13:01:22 GMT

Hi @sekhar463,

remember to use the sourcetype=juniper in you udp input.

Ciao.

Giuseppe

Re: Field extraction via props/transforms for juniper logs in splunk cloud

sekhar463 — Wed, 15 Feb 2023 13:13:53 GMT

where is it while doing inputs.conf file or in the device end while configuring to send syslogs

Re: Field extraction via props/transforms for juniper logs in splunk cloud

gcusello — Wed, 15 Feb 2023 13:30:08 GMT

HI @sekhar463,

sourcetype is defined by GUI or by inputs.conf file.

Ciao.

Giuseppe