LEEF format results in 1 liner entries into Splunk

[tan_junyuan]

For some reason, 1 liner entries are send to my splunk, after incapsula logs shifted to LEEF format. Initially, we were using CEF format.

sourcetype:incapsula
1 liner log entries look like this:
startTime:xxxxx

startTime:xxxx

endTime:xxxxxx

Vendor is unable to change on their end, anything we can do the Splunk side, to make it such that the entries can be recognized by Splunk?

[richgalloway]

You need to change your props.conf and/or transforms.conf settings. There are a few Incapsula apps at apps.splunk.com that may do the job for you. See https://splunkbase.splunk.com/app/4690 for one of them.

[tan_junyuan]

what do you mean by changing props.conf and transforms.conf, how does this LEEF format affect this? I can go props.conf and transforms.conf, there is a property that I can define as LEEF format?

[richgalloway]

There is no single property for LEEF or CEF. You must define combinations of the supported properties so Splunk knows how to process your data.
I'm not familiar with the Incapsula apps. Do they have options for LEEF?

[tan_junyuan]

yes, incapsula apps is already installed. Previously, CEF format works fine.