All Apps and Add-ons

Syslog Data is not being parsed correctly by Fortinet Fortigate App

scottrunyon
Contributor

Syslog data from my Fortinet firewall is not being parsed out correctly.   I have noticed that there are multiple formats of messages.   

This first format parses out correctly. 

...  policyid=474 sessionid=3929476361 user="FRED" group="RegularSupport.Grp" srcip=10.120.2.26 ... 

These do not (specifically the user field is not populated)

....   policyid=441 sessionid=3929476369 user="BARNEY" srcip=10.120.36.105   ....

(missing group after user field)

.....   policyid=471 sessionid=3929476336 user="BETTY" group="TL-AVP-SVP.Grp" srcip=10.120.2.128 ....

(has "-" in the text for group)

....   policyid=103 sessionid=3929476142 user="WILMA" group="Wkstns_SSLVPN_PD.Grp" srcip=172.24.1.18    ......

(has "_" in the text for group).

I tried to do a extract fields on one of the different events, that solved the issue for the new event but the original event no longer works.   

I assume that there is a regex somewhere that parses this out but I cannot find it.  My question is where do I go find out where it is so I can hopefully generate one that works?

 

Scott

 

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...