Getting Data In

Parsing McAfee Firewall Logs

weicai88
Path Finder

Hello All!

I am trying to parse McAfee firewall logs but the props.conf I am using doesn't seem to work.

This is my props.conf:

[source::<source location>]
TIME_PREFIX = Time:\s+
TIME_FORMAT = %m/%d/%Y %H:%M:%S
LINE_BREAKER = ([\r\n]+)Time:
SHOULD_LINEMERGE = false

This is the log that I want to break at each timestamp line:

Time: 03/04/2021 17:31:18
Event: Traffic
IP Address: 172.16.0.21
Description:
Path:
Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915)
Matched Rule: Block all traffic
Time: 03/04/2021 17:31:19
Event: Traffic
IP Address: 172.16.0.21
Description:
Path:
Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915)
Matched Rule: Block all traffic
Time: 03/04/2021 17:31:20
Event: Traffic
IP Address: 172.16.0.21
Description:
Path:
Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915)
Matched Rule: Block all traffic
Time: 03/04/2021 17:31:21
Event: Traffic
IP Address: 172.16.0.21
Description:
Path:
Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915)
Matched Rule: Block all traffic
Time: 03/04/2021 17:31:22
Event: Traffic
IP Address: 172.16.0.21
Description:
Path:
Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915)
Matched Rule: Block all traffic

...

 

Thank you so much!

Labels (5)
0 Karma
1 Solution

weicai88
Path Finder

Just figured it out, instead of using source, sourcetype should be used in the props.conf. Now I am seeing proper events break-up:

weicai88_0-1614957483098.png

 

View solution in original post

0 Karma

dave_null
Path Finder

From my perspective your props.conf looks good. Are your events currently being indexed line by line?

0 Karma

weicai88
Path Finder

Yeah, the vast majority are 1 line, and there are many other line counts. What I need is events with 7 lines.  BTW, the props.conf is on heavy forwarders to send to Splunk Cloud.

weicai88_0-1614954366545.png

 

0 Karma

weicai88
Path Finder

Just figured it out, instead of using source, sourcetype should be used in the props.conf. Now I am seeing proper events break-up:

weicai88_0-1614957483098.png

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...