Heavy forwarder and third-party system problem

Getting Data In

i have faced problem with Qradar and transformation of log (Trend micro)

i forwarded the log as a raw format from splunk HF to Qradar

i'm facing problem with the header of the events on Qradar they have double hostname and timestamp (date)

i tried to define syslogSourcetype = sourcetype::<sourcetype>

but same occuers they are double

is there a way to solve this problem please i'm trying now for 1 week to solve this issue

Thanks

Get Updates on the Splunk Community!

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Join the Conversation