Juniper VPN SA 2500 Source type

[ifsuser]

Hi

Which source type should i use when receiving data from my Juniper SA2500 box using UDP

thanks

[MarioM]

if you are using this app splunk-for-juniper-sa then you should use juniper_sa_log but it should automatically as per props.conf:

[source::udp:514]
TRANSFORMS-sasourcetype= sa_sourcetyper

and transforms.conf:

[sa_sourcetyper]
DEST_KEY = MetaData:Sourcetype
REGEX = Juniper\:\s[^\s]+\s[^\s]+\s-\sive
FORMAT = sourcetype::juniper_sa_log

[yesyes3]

Thanks, started to work after adding those lines to props.conf. Also had to modify regex to Juniper:\s[^\s]+\s[^\s]+\s-\s