Splunk 5.0.1 and Splunk LEA 2.0.1 log grabber

[richfoster]

I have an install of splunk 5.0.1 that was using an old lea-loggrabber app. I have installed the new Splunk support LEA grabber for OPSEC and now seem to have issues with my logs not showing anymore. I can see from tcpdump that the logs are being sent to the splunk server, however they do not show in splunk search. Also when trying to perform a search now I get the following errors
"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'opsec' and lookup table 'checkpoint_action_lookup'.

[krugger]

It wasn't working for me either.

I solved the problem by rewriting the parsing. This might not be the best solution and it might not work for you, because of diferences in the products. Anyway I hope it helps.

I first renamed the default/props.conf to default/props.bak and default/transforms.conf to default/transforms.bak. Then I created new props.conf nad transforms.conf in the local directory.

props.conf:

[opsec]

SHOULD_LINEMERGE = false

TIME_PREFIX = time=

TIME_FORMAT = %d%b%Y %H:%M:%S

REPORT-opsec = opsec

REPORT-opsec-message = opsec-message

transforms.conf:
[opsec]
REGEX = loc=\d+ filename=\S+ fileid=\d+ time=.\S+ \S+ action=(\S+) orig=(\S+) i\/f_dir=(\S+) i\/f_name=(\S+) has_accounting=\S+ product=(.) __policy_id_tag=.( rule=\d+)?( rule_uid=\S+)?( rule_name=.)?( service_id=\S+)? src=(\S+) s_port=(\S+) dst=(\S+) service=(\S+) proto=(\S+)( message_info=.)?( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)?( NAT_rulenum=\d+)?( NAT_addtnl_rulenum=\d+)?
FORMAT = action::$1 orig::$2 if_dir::$3 if_name::$4 product::$5 src::$6 s_port::$7 dst::$8 service::$9 proto::$10

[opsec-message]
REGEX = proto=\S+ message_info=(.*)( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)?
FORMAT = message::$1

[araitz]

I have filed OPSEC-95 and will attempt to reproduce.

UPDATE: I can reproduce the knowledge issues (i.e. the lookup table error). I am still working to reproduce the other knowledge issues.