All Apps and Add-ons

regex in Splunk_TA_juniper not matching logs

mirkokorn
Explorer

Hi there,

I'm currently onboarding juniper srx firewall data with the Splunk_TA_juniper. Unfortunately the format in the app does not match the logs produced by our devices.

For example the app does contain the following in transforms.conf:
[force_sourcetype_for_junos_firewall]
DEST_KEY = MetaData:Sourcetype
REGEX = \s+RT_FLOW:|\s+RT_IDS:
FORMAT = sourcetype::juniper:junos:firewall

Our logs look like this:
<Timestamp> <Hostname> RT_FLOW <Message>

So in our logs there is no colon after RT_FLOW. Is this a known problem with SRX firewalls in combination with the TA? I just wanted to make sure that there is no simple way around this before I go and rewrite all the regex to match our logs.

Thanks in advance.

mirkokorn
Explorer

Already found the answer, but just wanted to share in case anybody else runs into this problem.

We had the structured-data format enabled. Therefore the format didn't match the expectations of the app. Turned the option off and the app worked fine.

DBattisto
Communicator

I'm not a Juniper guy, so I had to look this up. Here's a good link:

https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/syslog-message-structure...

Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...