Why isn't the data parsing while using Barracuda WAF/ADC Add-on for Splunk?

[johnward4]

I'm sending Barracuda logs over UDP 514 and configuring my inputs to listen for, using the Barracuda WAF/ADC Add-on for Splunk :

[udp://514]
index = barracuda
source = barracuda:log
sourcetype = barracuda:log
disabled = 0

I'm only seeing the data coming into with a single eventtype = err0r and none of the fields are processed by the add-on props & transforms. I'm also looking to find a Barracuda app to display dashboard visualization with the data but none of the apps found in Splunkbase seem to work and/or outdated. Help appreciated, thanks, everyone.

[ekost · Accepted solution]

The Add-on leverages index-time transformations. If the data is coming in, is going into the correct index, but is not being source typed properly, then most likely the Add-on has not beed installed on the appropriate node. At a minimum, it'll need to be on the indexers. But if you're doing the collection (your UDP input) on a heavy forwarder, the Add-on would need to be installed there.
If that all looks good, you should compare the data you've collected in your index to the samples provided in the Add-on in /Splunk_TA_barracuda_waf_adc/samples/. They'll need to match, as there are regular expressions controlling the source type assignments.

[p_gurav]

This may help:
https://answers.splunk.com/answers/638463/why-are-the-logs-not-properly-parsing-for-the-barr.html