Getting Data In

Parsing CheckPoint Archive logs without "FW" tool

Tim80
New Member

Hi,
I have checkpoint archived logs stored in a binary format as described here :

    http://answers.splunk.com/answers/6490/import-checkpoint-archive-logs.html

can Splunk parse these files directly somehow ?

Instead of using the FW tool to convert them into CSV format and then import them to splunk.

I want to do that because my logs are much bigger than 2GB and the FW tool can only output 2GB at a time.

Many thanks in advance.

Tim Brewer

0 Karma

sobrien
Splunk Employee
Splunk Employee

Hi Tim,

No, Splunk cannot parse your binary log files. You need to either:

1 Export the logs from the management server using the fw logexport command
2. Setup the OPSEC LEA connector - https://splunkbase.splunk.com/app/1454/

The second option is the recommended approach, as this will give you a continued feed of logs into your Splunk platform for analysis.

HTH.

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...