Getting Data In

I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

DerekB
Splunk Employee
Splunk Employee

My Splunk setup is a UF sending to an indexer. That indexer is then forwarding everything to QRadar. When I look at the events in QRadar, they are mangled. What I see is each key value pair is its' own event instead of all of the pairs being part of a single event.

Example:

Real event looks like:

09-Sep-2012 14:48:29 AgentDevice=WindowsLog AgentLogFile=Security

But it's getting broke into separate events like this:

Event 1-
09-Sep-2012 14:48:29

Event 2-
AgentDevice=WindowsLogs

Event 3-
AgentLogfile=Security

Why?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

We've seen this before, and what we noticed was that when we looked at the single line event data the instance was generating, it was all showing up in QRadar normally. The problem turned out to be that QRadar doesn't understand how to deal with multiline events, so each line is handled as an individual event. We confirmed the behavior with the vendor, presently it is a limitation of the product.

View solution in original post

rajanala
Path Finder

DerekB,
Can you share Splunk configuration details for Forwarding all data from Splunk Indexer to QRadar ?
Will, having just the outputs.conf work?
outputs.conf
[tcpout]
defaultGroup = SIEM_12345
indexAndForward = true
disabled = false

[tcpout:SIEM_12345]
server = SIEM_IP:12345
compressed = true
sendCookedData = true

0 Karma

jmann2118
Explorer

You can upgrade to a newer version of Qradar which adds Splunk as a source and fixes this issue

jcrabb_splunk
Splunk Employee
Splunk Employee

Here is a document regarding the Qradar configuration from IBM's site:

http://www-01.ibm.com/support/knowledgecenter/SS42VS_7.2.5/com.ibm.dsm.doc/t_DSM_guide_Splunk_logsou...

Jacob
Sr. Technical Support Engineer
0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Yes, but it's good to have documented.

Ayn
Legend

Isn't this a QRadar issue rather than a Splunk issue?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

We've seen this before, and what we noticed was that when we looked at the single line event data the instance was generating, it was all showing up in QRadar normally. The problem turned out to be that QRadar doesn't understand how to deal with multiline events, so each line is handled as an individual event. We confirmed the behavior with the vendor, presently it is a limitation of the product.

buttona
Engager

Is this something that has been corrected since 2012? We are looking to do the same thing here with SystemOut and http access logs from Splunk indexer to QRadar.

Thanks.

0 Karma