How to get parsed PFsense logs into Splunk Cloud instance?

[shubhamk]

Hi

I am new to Splunk Cloud.
We're collecting some pfSense logs to a dedicated Syslog server and Splunk cloud is receiving those logs but they are not parsed properly. I have read a couple of articles but nothing specific to Splunk cloud.
Any ideas on how they can be parsed on Splunk cloud?

here are the sample logs.

[shubhamk]

Yes.. we have installed TA-pfsense on Search Heads and Indexers.

[ryg]

How did you install TA-pfsense on the Search heads? 

[General_Talos · Accepted solution]

Can you check if your sourcetype in inputs matching with defined add-on input and same with add-on props & transform conf.

You can install add-on on Splunk HF and perform the changes (because Splunk cloud doesn't gives you feasibility to perform for any changes in installed app on cloud infra, however you can achieve this changes via on-prem HF).

[shubhamk]

Thanks I had similar thoughts  but wasn't sure about it.

[richgalloway]

There are two apps for PFsense in Splunkbase.  Have you tried either one?