regex in Splunk_TA_juniper not matching logs

[mirkokorn]

Hi there,

I'm currently onboarding juniper srx firewall data with the Splunk_TA_juniper. Unfortunately the format in the app does not match the logs produced by our devices.

For example the app does contain the following in transforms.conf:
[force_sourcetype_for_junos_firewall]
DEST_KEY = MetaData:Sourcetype
REGEX = \s+RT_FLOW:|\s+RT_IDS:
FORMAT = sourcetype::juniper:junos:firewall

Our logs look like this:
<Timestamp> <Hostname> RT_FLOW <Message>

So in our logs there is no colon after RT_FLOW. Is this a known problem with SRX firewalls in combination with the TA? I just wanted to make sure that there is no simple way around this before I go and rewrite all the regex to match our logs.

Thanks in advance.

[mirkokorn]

Already found the answer, but just wanted to share in case anybody else runs into this problem.

We had the structured-data format enabled. Therefore the format didn't match the expectations of the app. Turned the option off and the app worked fine.

[DBattisto]

I'm not a Juniper guy, so I had to look this up. Here's a good link:

https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/syslog-message-structure...