We're running some pfSense (FreeBSD-based firewall) on our network and dumping it to a dedicated syslog-ng server. When splunk reads the dumped files in syslog, it doesn't break it apart into fields which is what I expected. pfSense uses the pf (packet filter) tool originally from OpenBSD to manage the firewall rules.
Here's a sample line from the log:
Jan 11 07:28:30 126.96.36.199 pf: 000145 rule 141/0(match): block in on bge0: (tos 0x0, ttl 128, id 58078, offset 0, flags [none], proto UDP (17), length 1052) 188.8.131.52.1137 > 184.108.40.206.24460: UDP, length 1024
Try looking here for more info: Parsing pfSense Logs Part 2
Short answer: When setting up the input file, assign a manual sourcetype of pfSense
Then include the following in props.conf
[pfSense] SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE=match
You will probably have to define the fields yourself. There are a couple of ways to do that:
Overview of Search-Time Field Extractions has an overview
Create search-time field extractions by editing configuration files - this is my preferred way to do this
Note: you do not want to use index-time extractions.