parsing checkpoint firewall log dates

[mpf]

hi,

I'm using the 'fw log -l -n -p ' command to dump some old firewall logs to text to get them into splunk 4.1.x. Splunk doesn't seem to want to parse the event dates correctly and I think it is ending up using the timestamp from the text file itself. The date and time in each event can look like:

' 1Jan2011  0:00:09  ...rest of event'
' 1Jan2011 20:00:09 ...'
'11Jan2011  0:00:09 ...'
'11Jan2011 20:00:09 ...'

Notice the space at the start of the event sometimes and there is also either a single or double space between the date and the time.

How can I teach splunk to recognise this date time stamp?

[Ron_Naken · Accepted solution]

If Splunk doesn't recognize those timestamps, use the following in props.conf:

[checkpoint]
TIME_FORMAT=%e%b%Y %k:%M:%S

Set your sourcetype to "checkpoint" and this will teach Splunk to recognize the timestamps.

By the way, there are Check Point apps posted here, if you want LEA integration: http://splunkbase.splunk.com/apps/All/4.x/app:OPSEC+LEA+for+Check+Point+(Linux) http://splunkbase.splunk.com/apps/All/4.x/app:OPSEC+LEA+for+Check+Point+(Solaris)

[mpf]

Thanks that worked. Note that the Splunk docs for TIME_FORMAT refer to strptime() man pages but it is doesn't have a %k. The strftime() man pages do.