All Apps and Add-ons

regex in Splunk_TA_juniper not matching logs

mirkokorn
Explorer

Hi there,

I'm currently onboarding juniper srx firewall data with the Splunk_TA_juniper. Unfortunately the format in the app does not match the logs produced by our devices.

For example the app does contain the following in transforms.conf:
[force_sourcetype_for_junos_firewall]
DEST_KEY = MetaData:Sourcetype
REGEX = \s+RT_FLOW:|\s+RT_IDS:
FORMAT = sourcetype::juniper:junos:firewall

Our logs look like this:
<Timestamp> <Hostname> RT_FLOW <Message>

So in our logs there is no colon after RT_FLOW. Is this a known problem with SRX firewalls in combination with the TA? I just wanted to make sure that there is no simple way around this before I go and rewrite all the regex to match our logs.

Thanks in advance.

mirkokorn
Explorer

Already found the answer, but just wanted to share in case anybody else runs into this problem.

We had the structured-data format enabled. Therefore the format didn't match the expectations of the app. Turned the option off and the app worked fine.

DBattisto
Communicator

I'm not a Juniper guy, so I had to look this up. Here's a good link:

https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/syslog-message-structure...

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!