Getting Data In

Parsing CheckPoint Archive logs without "FW" tool

New Member

I have checkpoint archived logs stored in a binary format as described here :

can Splunk parse these files directly somehow ?

Instead of using the FW tool to convert them into CSV format and then import them to splunk.

I want to do that because my logs are much bigger than 2GB and the FW tool can only output 2GB at a time.

Many thanks in advance.

Tim Brewer

0 Karma

Splunk Employee
Splunk Employee

Hi Tim,

No, Splunk cannot parse your binary log files. You need to either:

1 Export the logs from the management server using the fw logexport command
2. Setup the OPSEC LEA connector -

The second option is the recommended approach, as this will give you a continued feed of logs into your Splunk platform for analysis.


Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...