Linux firewalld TA

[biroby]

Hello community,

I'm new to Splunk Custom TA and would like to collect the Linux firewall log. I've searched the web to see if anyone has already done this, but I can't find anything.

I created a TA structure, but I have a problem: the PROTO field in the log can be numeric or string (I find TCP, UDP, or 1, 2, 47, etc.) and I want everything to be a descriptive string placed in the "transport" field.
I added this code to the props.conf, but it doesn't seem to work:

# -------------------------------
# Normalize transport (numeric + string proto)
# -------------------------------
EVAL-transport = case(
lower(proto)=="tcp" OR proto=="6", "tcp",
lower(proto)=="udp" OR proto=="17", "udp",
lower(proto)=="icmp" OR proto=="1", "icmp",
lower(proto)=="igmp" OR proto=="2", "igmp",
proto=="47", "gre",
proto=="50", "esp",
proto=="51", "ah",
lower(proto)=="icmp6" OR proto=="58", "icmp",
proto=="89", "ospf",
proto=="108", "ipip",
proto=="112", "vrrp",
proto=="115", "l2tp",
proto=="132", "sctp",
proto=="137", "mpls",
true(), "unknown"
)

If I use the single EVAL instead, it works:

EVAL-transport = lower(proto)

Could you help me?
Thanks

[PickleRick]

Wouldn't it be easier to do it with a lookup?

[livehybrid · Accepted solution]

Hi @biroby 

If you put it on one-line does it work?

You could also check with btool that its picking up correctly:

$SPLUNK_HOME/bin/splunk cmd btool props list <yourSourceType>

Check that you see the full eval returned. 

Another thing to check is running the eval as SPL in your search to ensure that you get the correct values returned, this is a good way to check without having to tweak and restart each time.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[biroby]

Hi @livehybrid ,

thanks for your post. The problem is case on multiline; after I updated my props.conf in a single line all running as expected.