Getting Data In

LEEF format results in 1 liner entries into Splunk

tan_junyuan
New Member

For some reason, 1 liner entries are send to my splunk, after incapsula logs shifted to LEEF format. Initially, we were using CEF format.

sourcetype:incapsula
1 liner log entries look like this:
startTime:xxxxx

startTime:xxxx

endTime:xxxxxx

Vendor is unable to change on their end, anything we can do the Splunk side, to make it such that the entries can be recognized by Splunk?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You need to change your props.conf and/or transforms.conf settings. There are a few Incapsula apps at apps.splunk.com that may do the job for you. See https://splunkbase.splunk.com/app/4690 for one of them.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

tan_junyuan
New Member

what do you mean by changing props.conf and transforms.conf, how does this LEEF format affect this? I can go props.conf and transforms.conf, there is a property that I can define as LEEF format?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no single property for LEEF or CEF. You must define combinations of the supported properties so Splunk knows how to process your data.
I'm not familiar with the Incapsula apps. Do they have options for LEEF?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

tan_junyuan
New Member

yes, incapsula apps is already installed. Previously, CEF format works fine.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!