Getting Data In

Checkpoint log exporter props

Path Finder


We have recently migrated from LEA to checkpoint log exporter facility to collect Checkpoint firewall logs in CEF format.

Even after trying multiple props configuration, we still observe events breaking at irregular intervals.

Some events parse correctly at the start and end of the event and some in between or abruptly.

we even tried the splunk add-on -

Does anyone have a working props?

Labels (1)
Tags (2)
0 Karma


Hi @shivarpith 

Can you share the sample events and how your props conf written?

How are you collecting these checkpoint firewall logs?


0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...