CEF parsing is not working

[riqbal47010]

we have one search head and one with Enterprise Security.

we have one index which named index=fireeye and logs are coming in CEF format.

on search head all the logs are being properly parsing but on ES, the logs are not being parsing.

[ragedsparrow]

This usually means that your configurations are not consistent across your search heads. Typically you would do most of your extractions at the indexing tier, but it appears that you are doing them at the Search layer.

You can try this running this on both Search Heads:

$SPLUNK_HOME$/bin/splunk btool props list <sourcetype>

$SPLUNK_HOME$ is where Splunk is installed (usually /opt/splunk on Linux). See if the output is the same on both search heads.

[riqbal47010]

I just removed the Fireeye Add-on from ES. and interesting all fields are being properly parsed as supposed to be. the logs are in CEF format.
can anyone explain what happened.

[ragedsparrow]

My best guess is a source/sourcetype override in the Fireye Add-on. You can use the btool command to do troubleshooting on your sourcetype and see what parsing is being applied to them.