Splunk Enterprise

Problem dropping events from fortinet

tdepablo88
Explorer

Hi,

When i drop traffic events on a Heavy Forwarder (fgt_traffic) my stanza don't work, its weird because in another heavy forwarder i have the same configuration and its works, mi props.conf and transforms.conf are:

props.conf

# FILTRO Eventos Fortinet Traffic
[fgt_log]
TRANSFORMS-filtro = filtrado_fortinet_traffic

transforms.conf

[filtrado_fortinet_traffic]
SOURCE_KEY = _raw
REGEX = \stype\=\"traffic\"\s
DEST_KEY = queue
FORMAT = nullQueue

best regards.

Diego.

Labels (1)
0 Karma
1 Solution

tdepablo88
Explorer

Hi,

Affirmative I put the same files on the first Heavy forwarder. yes I restart the HF after loading the files.

I'll close this question because the fortinets managers applied a filter on his appliances, to solve the issue I applied a filter because Fortinet didn't sent the corrects log files types.

thank you again Rich.

best regards.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Did you install the props.conf and transforms.conf files on the FIRST HF that sees the data? Did you restart the HF after loading the files?
---
If this reply helps you, Karma would be appreciated.

tdepablo88
Explorer

Hi,

Affirmative I put the same files on the first Heavy forwarder. yes I restart the HF after loading the files.

I'll close this question because the fortinets managers applied a filter on his appliances, to solve the issue I applied a filter because Fortinet didn't sent the corrects log files types.

thank you again Rich.

best regards.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...