Getting Data In
Highlighted

I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Splunk Employee
Splunk Employee

My Splunk setup is a UF sending to an indexer. That indexer is then forwarding everything to QRadar. When I look at the events in QRadar, they are mangled. What I see is each key value pair is its' own event instead of all of the pairs being part of a single event.

Example:

Real event looks like:

09-Sep-2012 14:48:29 AgentDevice=WindowsLog AgentLogFile=Security

But it's getting broke into separate events like this:

Event 1-
09-Sep-2012 14:48:29

Event 2-
AgentDevice=WindowsLogs

Event 3-
AgentLogfile=Security

Why?

Highlighted

Re: I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Splunk Employee
Splunk Employee

We've seen this before, and what we noticed was that when we looked at the single line event data the instance was generating, it was all showing up in QRadar normally. The problem turned out to be that QRadar doesn't understand how to deal with multiline events, so each line is handled as an individual event. We confirmed the behavior with the vendor, presently it is a limitation of the product.

View solution in original post

Highlighted

Re: I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Engager

Is this something that has been corrected since 2012? We are looking to do the same thing here with SystemOut and http access logs from Splunk indexer to QRadar.

Thanks.

0 Karma
Highlighted

Re: I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Legend

Isn't this a QRadar issue rather than a Splunk issue?

0 Karma
Highlighted

Re: I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Splunk Employee
Splunk Employee

Yes, but it's good to have documented.

Highlighted

Re: I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Explorer

You can upgrade to a newer version of Qradar which adds Splunk as a source and fixes this issue

Highlighted

Re: I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Splunk Employee
Splunk Employee

Here is a document regarding the Qradar configuration from IBM's site:

http://www-01.ibm.com/support/knowledgecenter/SS42VS_7.2.5/com.ibm.dsm.doc/t_DSM_guide_Splunk_logsou...

Jacob
Sr. Technical Support Engineer
0 Karma
Highlighted

Re: I am using third party forwarding from Splunk to QRadar but the events are not being displayed correctly. How can I correct this?

Path Finder

DerekB,
Can you share Splunk configuration details for Forwarding all data from Splunk Indexer to QRadar ?
Will, having just the outputs.conf work?
outputs.conf
[tcpout]
defaultGroup = SIEM_12345
indexAndForward = true
disabled = false

[tcpout:SIEM12345]
server = SIEM
IP:12345
compressed = true
sendCookedData = true

0 Karma