Checkpoint Firewall Logs in Splunk

[dpatnam]

Hello All,

I am trying to import some of my Checkpoint firewall logs into Splunk. I tried to setup a sample input to index the text format of these logs, but am running into issues with the header and timestamp extraction -

Here's a sample (pruned down) semi-colon separated input from the logs -

num;date;time;orig;type
0;22Mar2011;0:55:11;0.0.0.0;control
1;21Mar2011;7:09:41;0.0.0.1;log

Here are the entries in my props.conf to extract the timestamp and the header info for these logs -

TIME_PREFIX = ^\d+;
TIME_FORMAT = %DD%MMM%YYYY;%H:%M:%S
SHOULD_LINEMERGE = false
TZ=GMT
CHECK_FOR_HEADER = true

However, it looks like Splunk is only recognizing the time and the timezone configuration but it is setting the date to the current day (Apr 5th) and is also not extracting any of the headers for the events. Any help in figuring out where I am going wrong would be greatly appreciated.

Thank you.

[hazekamp]

dpatnam,

For TIME_FORMAT be sure to use strptime specifiers like so:

TIME_FORMAT = %d%B%Y;%H:%M:%S

See also: http://docs.python.org/library/time.html

[dpatnam]

Thanks hazedav and gkanapathy. I went the FIELDS/DELIMS route and got the header extraction to work as well.

[gkanapathy]

Agree with Dave. Do not use CHECK_FOR_HEADER, certainly not if your fields are known and fixed. Just specify the fields and delims manually.

[hazekamp]

I would highly discourage CHECK_FOR_HEADER and recommend FIELDS/DELIMS

[dpatnam]

Thanks hazedav. Just a shortwhile before you posted the answers, I found another link that has all the time specifiers (http://dev.mysql.com/doc/refman/5.5/en/date-and-time-functions.html)

After referring to the specifiers in this link , I changed the TIME_FORMAT as shown below and am now able to extract the correct date as well.

TIME_FORMAT = %d%b%Y;%H:%M:%S

The only outstanding item for me now is the header extraction. I am still looking into this.