Splunk not formatting AMP logs

[jaridaycock]

I will preface by saying I am very new to using Splunk. We have recently did a rebuild of our environment and I noticed that one of our log sources does not return formatted logs the same way our other log sources do. Whenever I try and do a query for AMP (Cisco Secure Endpoint) I have to click 'Show as raw text' to see any data which does not seem right to me. 

I have been trying to extract fields using Rex as well and it just does not seem to be working and I'm not sure if it has something to do with how the logs are displaying when I do a query. Could someone point me in the right direction?

[marnall · Accepted solution]

At search time, you could use spath to navigate past the "event:" part of the log:

<yoursearch>
| spath path=event output=_raw

However you may want a solution that does not require spath on every search. You can configure your indexing tier to remove the "event:" part of the log, so that it directly shows you the useful fields without needing to be expanded.

On the indexing tier, make a props.conf file in an app e.g.
/opt/splunk/etc/apps/yourappname/local/props.conf

Make this stanza:

[cisco:amp:event]
SEDCMD-RemoveEventKey = s/{"event":\s*//
SEDCMD-RemoveLastBracket = s/}$//

 (and more stanzas for other sourcetypes you would like this change to apply to)