Splunk Search

How to create a custom CEF index for CEF Syslog data and extract token field field names and values?

grantsales
Engager

I'm looking for help on creating a custom CEF index.

I have CEF Syslog data sent into my Splunk instance and I'd like to index some of the tokened fields and simply parse the others.

I know how to do regex extractions for each field, but there has to be a better way to tell splunk there is a CEF header and following a header is the token field names and values.

I want these to be indexed prior to searching for performance.

I do not know if this will scale, but I want to try it.

Can anyone help?

0 Karma

curryRick
Explorer

I know this is an 'older' question, but I am getting into the possibility that I too will be working with CEF data. II take it that what you refer to as the "tokened fields" that you mean the "cs#=" and the "cs#label=" fields that are in the "Extension" portion of the messages.

I have not seen anything that indicates there is a way for Splunk to auto-ingest/field extract CEF data. You will likely need to create a transforms to do that and the RegEx should be fairly straight forward for that.

More importantly, I am not sure you'd want to extract these fields at index time; the savings you'd get at search time with this is not likely to be worth the performance impact on index processing to do the extraction and indexing together. I suggest you keep to search time field extractions.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...