Getting Data In

FortiAnalzer Field Extraction

Rhidian
Path Finder

Hi,

I'm receiving FortiGate event via FortiAnalyser and I need to set the Host to the name of the device that created the event which is contained in the event message as devname.

May 10 10:44:30 10.90.223.5 date=2021-05-10 time=11:44:30 devname="test" devid="test" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1620643470882685981 tz="+0100" srcip= srcport=62408 srcintf="" srcintfrole="undefined" dstip= dstport=53 dstintf="port2" dstintfrole="wan" sessionid=81948384 proto=17 action="accept" policyid=23 policytype="policy" poluuid="cbd3e37e-5bf1-51eb-f2ad-0a49a47d1d1d" service="Domain Services UDP" dstcountry="Reserved" srccountry="Reserved" trandisp="noop" duration=180 sentbyte=76 rcvdbyte=194 sentpkt=1 rcvdpkt=1 vpn="" vpntype="ipsec-dynamic" appcat="unscanned"

 

I have started to build the transform below but it doesn't work.

[Set-Host-By-Devname]

REGEX = ([^.+?devname=\"[A-Z0-9]+")

FORMAT = host::$1

DEST_KEY = MetaData:Host

 

0 Karma
1 Solution

Rhidian
Path Finder

Sure

[fortigate_log]
TRANSFORMS-Set-Host-By-DevName
SHOULD_LINEMERGE = false

View solution in original post

0 Karma

aasabatini
Motivator

Hi @Rhidian 

Can you share also your props.conf?

 

 

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

Rhidian
Path Finder

Sure

[fortigate_log]
TRANSFORMS-Set-Host-By-DevName
SHOULD_LINEMERGE = false

0 Karma

aasabatini
Motivator

Hi @Rhidian 

try your props like this

[fortigate_log]
TRANSFORMS-meta = Set-Host-By-Devname
SHOULD_LINEMERGE = false

if doesn't works we need to works on your regex

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

Rhidian
Path Finder

No joy I think it is the regex...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...