Palo/Splunk Parsing Issue - Field values are Truncating

ghostdog920 — Tue, 15 Jun 2021 19:12:02 GMT

Having a strange issue and not sure what my culprit/problem is. Have a panorama to syslogng to Heavy Forwarder to Indexer with a single search head. I see the parsing (I think) where fields are found and values= but they are truncating. Specifically, my raw event has this in it:

before_change_detail="Emergency by IP { static [ ""Jim CentOS"" ]; } " after_change_detail=Emergency by IP { }

but when i look at the field values, this is what i get:

Any ideas on why my field values are getting cut short?

Palo/Splunk Parsing Issue - Field values are Truncating

ghostdog920 — Thu, 01 Jul 2021 19:13:11 GMT

Finally got this all straightened out. Needed to use cef utils for splunk along with a separate syslog destination from my panorama with custom cef events setup for the config section to get what i wanted.

topic Palo/Splunk Parsing Issue - Field values are Truncating in Splunk Search

Palo/Splunk Parsing Issue - Field values are Truncating

Palo/Splunk Parsing Issue - Field values are Truncating