All Apps and Add-ons

How-To Install (SearchHead/Indexer) Common Event Format Extraction Utilities

somasta
Engager

I have a lot of CEF Events in my Splunk Server and would like to install CEFUtils - Common Event Format Extraction Utilities. Normally decompress the file and place it in \Splunk\etc\apps.
But I never know if I have to install it on the searchhead or on the indexer. Is there a way

0 Karma
1 Solution

gooza
Communicator

install it on the search head since it reports the fields you want,
on the indexer (OR splunk forwarder if you use one) you make the necessary changes to the relevant stanza for time recognition.

[stanzaname]

TIME_PREFIX = \s(end|rt)=

TIME_FORMAT = %10S%3n

MAX_TIMESTAMP_LOOKHEAD = 350

the max timestamp lookahead length changes according to the CEF data received

View solution in original post

gooza
Communicator

install it on the search head since it reports the fields you want,
on the indexer (OR splunk forwarder if you use one) you make the necessary changes to the relevant stanza for time recognition.

[stanzaname]

TIME_PREFIX = \s(end|rt)=

TIME_FORMAT = %10S%3n

MAX_TIMESTAMP_LOOKHEAD = 350

the max timestamp lookahead length changes according to the CEF data received

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...