Getting Data In

Checkpoint log exporter props

Path Finder


We have recently migrated from LEA to checkpoint log exporter facility to collect Checkpoint firewall logs in CEF format.

Even after trying multiple props configuration, we still observe events breaking at irregular intervals.

Some events parse correctly at the start and end of the event and some in between or abruptly.

we even tried the splunk add-on -

Does anyone have a working props?

Labels (1)
Tags (2)
0 Karma


Hi @shivarpith 

Can you share the sample events and how your props conf written?

How are you collecting these checkpoint firewall logs?


0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...