Getting Data In

Transforms.conf devid

tel
Engager

Hello,

We are encountering a problem with the parsing on the fortigate add-on.
It does not recognize the devid of our equipment.
This fortigate having a serial number starting with FD, it was not taken into account by the regex.

regex: ^.+?devid=\"?F(?:G|W|\dK).+?(?:\s |\,|\,\s)type=\"?(traffic|utm|event|anomaly)

From the stanza: [force_sourcetype_fortigate]

We updated it on our side, but is this behavior normal?

Thanks in advance,
Best regards.

Labels (1)
Tags (1)
0 Karma
1 Solution

deepakc
Builder

Sometimes you do encounter some extractions are not working as expected and  sometimes logs change, so if encountered, then apply the fix to local config as you have done  otherwise it will get overwritten with a new version of the TA. AS this is developed by FortiGate, there may be an email you can send them, so they can fix it for the next version, look for the details via the Splunk base or documentation.

View solution in original post

0 Karma

deepakc
Builder

Sometimes you do encounter some extractions are not working as expected and  sometimes logs change, so if encountered, then apply the fix to local config as you have done  otherwise it will get overwritten with a new version of the TA. AS this is developed by FortiGate, there may be an email you can send them, so they can fix it for the next version, look for the details via the Splunk base or documentation.

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...