Splunk Search

Palo/Splunk Parsing Issue - Field values are Truncating

ghostdog920
Path Finder

Having a strange issue and not sure what my culprit/problem is.  Have a panorama to syslogng to Heavy Forwarder to Indexer with a single search head.  I see the parsing (I think) where fields are found and values= but they are truncating.  Specifically, my raw event has this in it:

before_change_detail="Emergency by IP { static [ ""Jim CentOS"" ]; } " after_change_detail=Emergency by IP { }

 

but when i look at the field values, this is what i get:

ghostdog920_0-1623784274273.png

 

Any ideas on why my field values are getting cut short?

Labels (1)
0 Karma
1 Solution

ghostdog920
Path Finder

Finally got this all straightened out.  Needed to use cef utils for splunk along with a separate syslog destination from my panorama with custom cef events setup for the config section to get what i wanted.

View solution in original post

0 Karma

ghostdog920
Path Finder

Finally got this all straightened out.  Needed to use cef utils for splunk along with a separate syslog destination from my panorama with custom cef events setup for the config section to get what i wanted.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...