Best 'monitor' setup for firewall logs

[SplunkUser5888]

Hey guys, Noob here;

I wanted to know what you thought would be the best setup to use the monitor function in inputs.conf to monitor firewall logs.
I've read the inputs.conf.specs file and there are a lot of attributes, but I'm not sure which should be used and with which regex.

I'm not looking for a specific answer just what you lot think is the best setup for monitoring a firewall log.

Thanks

[Drainy · Accepted solution]

Well with that sort of question you won't get a very specific answer 🙂

It depends entirely on how you're outputting the logs from your firewall, just as a general rule based on most firewalls you would output it as syslog over UDP to a local syslogd. This would write the log to disc and Splunk would be configured with a monitor stanza to index the contents.

Additional options are only needed if you have a specific index you want it to hit. By default just adding the stanza and a sourcetype would probably handle most of what you want to do.
Another consideration is looking at any Apps which may exist for your firewall on Splunkbase already, if so download it and figure out what sourcetype it expects, you can then configure this within the inputs.conf so everything works straight out of the box. Most apps of this kind come with pre-defined extractions so you only need to handle the input and sourcetyping.

If there isn't an app available you will need to build your own extractions in props and transforms which is something you can come back here for additional help with.

Also worth considering the timezone offsets, line breaking etc that is all configured within props. If you hit any more specific problems then feel free to come back with another question 🙂

Inputs.conf Documentation

Props.conf Documentation

[SplunkUser5888]

Hey, I left the question to see if there would be any other opinions and ideas, but there is nothing else. I thought, as you have helped, that I would make your answer the right one.

Thanks

[SplunkUser5888]

Thank you that was very helpful, I don't know anything about the firewall (intern... not check the firewall). But you've brought up some interesting stuff, I'll leave it unanswered to see if anyone else has something to share but thanks again.