Getting Data In

Transforms.conf devid

tel
Engager

Hello,

We are encountering a problem with the parsing on the fortigate add-on.
It does not recognize the devid of our equipment.
This fortigate having a serial number starting with FD, it was not taken into account by the regex.

regex: ^.+?devid=\"?F(?:G|W|\dK).+?(?:\s |\,|\,\s)type=\"?(traffic|utm|event|anomaly)

From the stanza: [force_sourcetype_fortigate]

We updated it on our side, but is this behavior normal?

Thanks in advance,
Best regards.

Labels (1)
Tags (1)
0 Karma
1 Solution

deepakc
Builder

Sometimes you do encounter some extractions are not working as expected and  sometimes logs change, so if encountered, then apply the fix to local config as you have done  otherwise it will get overwritten with a new version of the TA. AS this is developed by FortiGate, there may be an email you can send them, so they can fix it for the next version, look for the details via the Splunk base or documentation.

View solution in original post

0 Karma

deepakc
Builder

Sometimes you do encounter some extractions are not working as expected and  sometimes logs change, so if encountered, then apply the fix to local config as you have done  otherwise it will get overwritten with a new version of the TA. AS this is developed by FortiGate, there may be an email you can send them, so they can fix it for the next version, look for the details via the Splunk base or documentation.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...