How to configure CEF Extraction Add-on for Splunk Enterprise on the Search Head, Indexer or Heavy Forwarder?

[reswob4]

So I have a device which sends it logs in CEF format via syslog. This is not an ArcSight connector. I have configured this device to send these logs to a syslog server which in turn writes them to a file /var/log/<date>-device.log and I have setup the server as a Heavy Forwarder which monitors that file (and others) and sends those events to an Indexer where I now access those events via my SearchHead.

So I installed the CEF (Common Event Format) Extraction Add-on for Splunk Enterprise to correctly parse these logs. But while all the posts about properly configuring this addon talk about modifying the props.conf and properly placing the transforms.conf file, I'm not sure which props.conf to modify and where to place the transforms.conf.

Normally on the Search Head, I would modify the props.conf and transforms.conf in the app, but there is no app in this case, and there is not a local/props.conf under /opt/splunk/etc/apps/SplunkForwarder. There is a default/props.conf under /opt/splunk/etc/apps/SplunkLightForwarder/, but I don't know if that's the right place.

I have the same issue with the Heavy Forwarder and the Indexer, not sure what props.conf to modify and not sure where to put the transforms.conf.

I tried to modify the props.conf and transforms.conf in the SearchHead, after installing the addon, but that doesn't seem to have fixed it...

Suggestions?

Thanks.

[IgorB · Accepted solution]

Hi,

The add-on contains configurations that are used both at index time (Parsing/Merging pipelines) and at search time, so you need to install it on the Heavy Forwarders and on the Search Heads.

Basically, what you need to do is to install the add-on all relevant Splunk instances (see above) and either:

1. Modify the relevant inputs.conf on the Heavy Forwarder to set sourcetype for CEF logs collected by the HF to cefevents or
2. copy the props.conf supplied with the add-on to $SPLUNK_HOME/etc/apps/cefutil/local and modify the stanza name to match your sourcetype or source.

BR
--Igor

[reswob4]

OK, that is working. Thanks.

As you noted I had to do this for each and every Splunk instance. In my case, the HF, the Indexer and the Search Head.

and as an fyi, because I'm using a rotating log format for the syslog log file the HF is reading from, the stanza name to match my source turned out to be:
[source::.../log/mymachineIP/*_logname.log]

[IgorB]

Glad I could help.

A small note - in a distributed environment there's really no need to install the add-on on the indexer(s) if the data is collected by a Heavy Forwarder and you are using a Search Head to run your searches.