Heavy forwarder and third-party system problem

Getting Data In

i have faced problem with Qradar and transformation of log (Trend micro)

i forwarded the log as a raw format from splunk HF to Qradar

i'm facing problem with the header of the events on Qradar they have double hostname and timestamp (date)

i tried to define syslogSourcetype = sourcetype::<sourcetype>

but same occuers they are double

is there a way to solve this problem please i'm trying now for 1 week to solve this issue

Thanks

Get Updates on the Splunk Community!

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Join the Conversation