Getting Data In

LEEF format results in 1 liner entries into Splunk

tan_junyuan
Engager

For some reason, 1 liner entries are send to my splunk, after incapsula logs shifted to LEEF format. Initially, we were using CEF format.

sourcetype:incapsula
1 liner log entries look like this:
startTime:xxxxx

startTime:xxxx

endTime:xxxxxx

Vendor is unable to change on their end, anything we can do the Splunk side, to make it such that the entries can be recognized by Splunk?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You need to change your props.conf and/or transforms.conf settings. There are a few Incapsula apps at apps.splunk.com that may do the job for you. See https://splunkbase.splunk.com/app/4690 for one of them.

---
If this reply helps you, Karma would be appreciated.
0 Karma

tan_junyuan
Engager

what do you mean by changing props.conf and transforms.conf, how does this LEEF format affect this? I can go props.conf and transforms.conf, there is a property that I can define as LEEF format?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no single property for LEEF or CEF. You must define combinations of the supported properties so Splunk knows how to process your data.
I'm not familiar with the Incapsula apps. Do they have options for LEEF?

---
If this reply helps you, Karma would be appreciated.
0 Karma

tan_junyuan
Engager

yes, incapsula apps is already installed. Previously, CEF format works fine.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...