https://community.splunk.com/t5/Splunk-Search/How-to-create-a-custom-CEF-index-for-CEF-Syslog-data-and-extract/m-p/150380#M42140 <P>I'm looking for help on creating a custom CEF index. </P> <P>I have CEF Syslog data sent into my Splunk instance and I'd like to index some of the tokened fields and simply parse the others. </P> <P>I know how to do regex extractions for each field, but there has to be a better way to tell splunk there is a CEF header and following a header is the token field names and values. </P> <P>I want these to be indexed prior to searching for performance. </P> <P>I do not know if this will scale, but I want to try it. </P> <P>Can anyone help?</P> Tue, 24 Feb 2015 17:31:18 GMT grantsales 2015-02-24T17:31:18Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-custom-CEF-index-for-CEF-Syslog-data-and-extract/m-p/150380#M42140 <P>I'm looking for help on creating a custom CEF index. </P> <P>I have CEF Syslog data sent into my Splunk instance and I'd like to index some of the tokened fields and simply parse the others. </P> <P>I know how to do regex extractions for each field, but there has to be a better way to tell splunk there is a CEF header and following a header is the token field names and values. </P> <P>I want these to be indexed prior to searching for performance. </P> <P>I do not know if this will scale, but I want to try it. </P> <P>Can anyone help?</P> Tue, 24 Feb 2015 17:31:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-custom-CEF-index-for-CEF-Syslog-data-and-extract/m-p/150380#M42140 grantsales 2015-02-24T17:31:18Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-custom-CEF-index-for-CEF-Syslog-data-and-extract/m-p/150381#M42141 <P>I know this is an 'older' question, but I am getting into the possibility that I too will be working with CEF data. II take it that what you refer to as the "tokened fields" that you mean the "cs#=" and the "cs#label=" fields that are in the "Extension" portion of the messages.</P> <P>I have not seen anything that indicates there is a way for Splunk to auto-ingest/field extract CEF data. You will likely need to create a transforms to do that and the RegEx should be fairly straight forward for that.</P> <P>More importantly, I am not sure you'd want to extract these fields at index time; the savings you'd get at search time with this is not likely to be worth the performance impact on index processing to do the extraction and indexing together. I suggest you keep to search time field extractions.</P> Mon, 09 Nov 2015 17:35:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-custom-CEF-index-for-CEF-Syslog-data-and-extract/m-p/150381#M42141 curryRick 2015-11-09T17:35:25Z