Extract fields from different security devices to a unified field format

[vrajshekar]

I am currently planning to forwards logs from multiple security devices to Splunk Enterprise.

I would like to know if its possible to extract fields from different log sources in a unified field format.

For Eg: I forward logs from Firewall, Proxy and Endpoint Security products. Since different vendors would be following different naming conventions in their logs. Is it possible to standardize this when parsing and indexing. From all these device logs, i want certain important fields.

[richgalloway · Accepted solution]

Each source should be parsed and extracted separately.  When you do so, however, use the same field names for each source.  Then you can reference the common name regardless of the source.  This is how the Common Information Model (CIM) works (although you don't have to use the CIM app).

If you want to learn more about CIM, see https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview