Getting Data In

Transforms.conf devid

tel
Engager

Hello,

We are encountering a problem with the parsing on the fortigate add-on.
It does not recognize the devid of our equipment.
This fortigate having a serial number starting with FD, it was not taken into account by the regex.

regex: ^.+?devid=\"?F(?:G|W|\dK).+?(?:\s |\,|\,\s)type=\"?(traffic|utm|event|anomaly)

From the stanza: [force_sourcetype_fortigate]

We updated it on our side, but is this behavior normal?

Thanks in advance,
Best regards.

Labels (1)
Tags (1)
0 Karma
1 Solution

deepakc
Builder

Sometimes you do encounter some extractions are not working as expected and  sometimes logs change, so if encountered, then apply the fix to local config as you have done  otherwise it will get overwritten with a new version of the TA. AS this is developed by FortiGate, there may be an email you can send them, so they can fix it for the next version, look for the details via the Splunk base or documentation.

View solution in original post

0 Karma

deepakc
Builder

Sometimes you do encounter some extractions are not working as expected and  sometimes logs change, so if encountered, then apply the fix to local config as you have done  otherwise it will get overwritten with a new version of the TA. AS this is developed by FortiGate, there may be an email you can send them, so they can fix it for the next version, look for the details via the Splunk base or documentation.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...