My Splunk setup is a UF sending to an indexer. That indexer is then forwarding everything to QRadar. When I look at the events in QRadar, they are mangled. What I see is each key value pair is its' own event instead of all of the pairs being part of a single event.
Real event looks like:
09-Sep-2012 14:48:29 AgentDevice=WindowsLog AgentLogFile=Security
But it's getting broke into separate events like this:
We've seen this before, and what we noticed was that when we looked at the single line event data the instance was generating, it was all showing up in QRadar normally. The problem turned out to be that QRadar doesn't understand how to deal with multiline events, so each line is handled as an individual event. We confirmed the behavior with the vendor, presently it is a limitation of the product.
Is this something that has been corrected since 2012? We are looking to do the same thing here with SystemOut and http access logs from Splunk indexer to QRadar.
Isn't this a QRadar issue rather than a Splunk issue?
Yes, but it's good to have documented.
You can upgrade to a newer version of Qradar which adds Splunk as a source and fixes this issue
Here is a document regarding the Qradar configuration from IBM's site:
Can you share Splunk configuration details for Forwarding all data from Splunk Indexer to QRadar ?
Will, having just the outputs.conf work?
defaultGroup = SIEM_12345
indexAndForward = true
disabled = false
server = SIEMIP:12345
compressed = true
sendCookedData = true