I am trying to use Real Time Output App to generate CEF format log from syslog but not getting the clue how I can setup the search and assign the designated source file to this app. Anyone there to help me out on usage of this app.
The app looks for specifically named fields which it will then translate into cef field names, and that is pretty much it.
How we've used it is to output specific events that match a splunk query.
Create a new output select cef and syslog. Choose your destination ip/port/procotol.
Don't use the output assistant just make your own cef fields. There are some default ones that will be translated automatically. You can see a list of these in SplunkRealTimeOutput/bin/real_time_output/cef/ceftool.py
Example : You MUST put the word "search" at the front of your query! If you use cef_field_map you can make other fields map to cef fields that aren't explicitly named in the ceftool.py script.