Getting Data In

What would be the most efficient way of parsing pfSense 2.2 logs' new format? Regex, CSV or some other way?



I've been using Splunk for a while but only in a very basic way, by monitoring my Kiwi syslog files.

pfSense 2.2 is currently in release candidate stage and a new log format has been introduced with this version. Among other things, this avoids the multi-line syslog problems documented elsewhere in Splunk>answers.

The documentation about the new log format is located here:

Firstly, what would be the most efficient way of parsing these logs in Splunk? With regex, as CSV or some other way?

It also seems that, depending on the value of one field, the following fields will vary. How is it possible to take that into account during the parsing?

Any help very much appreciated. Thanks.

Tags (3)

Splunk Employee
Splunk Employee

I ended up using REGEX to parse the logs since it has different fields depending on the type of protocol (TCP, UDP, etc.) I can share with you what I did to parse the pfsense logs in my Home Monitor App for Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...