In Splunk Cloud, juniper logs can be extracted using props and transforms: How to do field attraction?

[btsmerchstor78]

We use Splunk cloud and one on-premises HF
Using Splunk_TA_juniper in Splunk cloud, we get Juniper logs as syslogs
What I need to do to do field attraction

[gcusello]

Hi @btsmerchstor78,

the Juniper_TA makes transformations and sourcetype override, so you have to install the TA also on your on-premise HF that's the first full Splunk instance that your Juniper data passing through.

By default in the TA there isn't any input, so in your input you have to assign the sourcetype "juniper" to your data source, so the add-on takes these logs and makes a transformation assigning the correct sourcetypes and parsing rules.

It's important that the input you enabled is done following the instructions of the above documentation.

Ciao.

Giuseppe