All Apps and Add-ons

regex in Splunk_TA_juniper not matching logs

mirkokorn
Explorer

Hi there,

I'm currently onboarding juniper srx firewall data with the Splunk_TA_juniper. Unfortunately the format in the app does not match the logs produced by our devices.

For example the app does contain the following in transforms.conf:
[force_sourcetype_for_junos_firewall]
DEST_KEY = MetaData:Sourcetype
REGEX = \s+RT_FLOW:|\s+RT_IDS:
FORMAT = sourcetype::juniper:junos:firewall

Our logs look like this:
<Timestamp> <Hostname> RT_FLOW <Message>

So in our logs there is no colon after RT_FLOW. Is this a known problem with SRX firewalls in combination with the TA? I just wanted to make sure that there is no simple way around this before I go and rewrite all the regex to match our logs.

Thanks in advance.

mirkokorn
Explorer

Already found the answer, but just wanted to share in case anybody else runs into this problem.

We had the structured-data format enabled. Therefore the format didn't match the expectations of the app. Turned the option off and the app worked fine.

DBattisto
Communicator

I'm not a Juniper guy, so I had to look this up. Here's a good link:

https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/syslog-message-structure...

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...