Best syslog format for McAfee Sidewinder logs forwarded to Splunk

[johnwsrns]

What is the best practice for formating syslogs forwarded to Splunk from a McAfee Sidewinder firewall? The choices are: W3C Extend Log Format (HTTP), Extensible Markup Language (XML), Binary or RAW (bin), American Standard Code of Information Interchange (ascii), or Verbose American Standard Code of Information Interchange(vascii). Excluded are vendor specific formats: Sidewinder Export Format (SEF) and WebTrends Extended Logging Format (WELF). Justification for choice?

[gkanapathy]

ASCII or w3c, or possibly XML. It would of course be probably more relevant if the formats had different data, or if there were more or less structure or info in one than the other. I don't know what vascii is, but if it's just ascii with more info, maybe that's better.