topic Re: Linux firewalld TA in Splunk Enterprise Security

Linux firewalld TA

biroby — Thu, 05 Feb 2026 10:45:33 GMT

Hello community,

I'm new to Splunk Custom TA and would like to collect the Linux firewall log. I've searched the web to see if anyone has already done this, but I can't find anything.

I created a TA structure, but I have a problem: the PROTO field in the log can be numeric or string (I find TCP, UDP, or 1, 2, 47, etc.) and I want everything to be a descriptive string placed in the "transport" field.
I added this code to the props.conf, but it doesn't seem to work:

# -------------------------------
# Normalize transport (numeric + string proto)
# -------------------------------
EVAL-transport = case(
lower(proto)=="tcp" OR proto=="6", "tcp",
lower(proto)=="udp" OR proto=="17", "udp",
lower(proto)=="icmp" OR proto=="1", "icmp",
lower(proto)=="igmp" OR proto=="2", "igmp",
proto=="47", "gre",
proto=="50", "esp",
proto=="51", "ah",
lower(proto)=="icmp6" OR proto=="58", "icmp",
proto=="89", "ospf",
proto=="108", "ipip",
proto=="112", "vrrp",
proto=="115", "l2tp",
proto=="132", "sctp",
proto=="137", "mpls",
true(), "unknown"
)

If I use the single EVAL instead, it works:

EVAL-transport = lower(proto)

Could you help me?
Thanks

Re: Linux firewalld TA

livehybrid — Thu, 05 Feb 2026 12:33:39 GMT

Hi @biroby

If you put it on one-line does it work?

You could also check with btool that its picking up correctly:

$SPLUNK_HOME/bin/splunk cmd btool props list <yourSourceType>

Check that you see the full eval returned.

Another thing to check is running the eval as SPL in your search to ensure that you get the correct values returned, this is a good way to check without having to tweak and restart each time.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Linux firewalld TA

PickleRick — Thu, 05 Feb 2026 21:20:12 GMT

Wouldn't it be easier to do it with a lookup?

Re: Linux firewalld TA

biroby — Fri, 06 Feb 2026 07:38:20 GMT

Hi @livehybrid ,

thanks for your post. The problem is case on multiline; after I updated my props.conf in a single line all running as expected.