I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

[DerekB]

My Splunk setup is a UF sending to an indexer. That indexer is then forwarding everything to QRadar. When I look at the events in QRadar, they are mangled. What I see is each key value pair is its' own event instead of all of the pairs being part of a single event.

Example:

Real event looks like:

09-Sep-2012 14:48:29 AgentDevice=WindowsLog AgentLogFile=Security

But it's getting broke into separate events like this:

Event 1-
09-Sep-2012 14:48:29

Event 2-
AgentDevice=WindowsLogs

Event 3-
AgentLogfile=Security

Why?

[rajanala]

DerekB,
Can you share Splunk configuration details for Forwarding all data from Splunk Indexer to QRadar ?
Will, having just the outputs.conf work?
outputs.conf
[tcpout]
defaultGroup = SIEM_12345
indexAndForward = true
disabled = false

[tcpout:SIEM_12345]
server = SIEM_IP:12345
compressed = true
sendCookedData = true

[jmann2118]

You can upgrade to a newer version of Qradar which adds Splunk as a source and fixes this issue

[jcrabb_splunk]

Here is a document regarding the Qradar configuration from IBM's site:

http://www-01.ibm.com/support/knowledgecenter/SS42VS_7.2.5/com.ibm.dsm.doc/t_DSM_guide_Splunk_logsou...

[jbsplunk]

Yes, but it's good to have documented.

[Ayn]

Isn't this a QRadar issue rather than a Splunk issue?

[jbsplunk · Accepted solution]

We've seen this before, and what we noticed was that when we looked at the single line event data the instance was generating, it was all showing up in QRadar normally. The problem turned out to be that QRadar doesn't understand how to deal with multiline events, so each line is handled as an individual event. We confirmed the behavior with the vendor, presently it is a limitation of the product.

[buttona]

Is this something that has been corrected since 2012? We are looking to do the same thing here with SystemOut and http access logs from Splunk indexer to QRadar.

Thanks.