checkpoint Log R80.10 with log forwarder to Splunk (win) field extraction

[sworton]

Hi - We're on R80.10 and the logs are coming through fine into a separate index.

I've installed the Check Point App for Splunk and set the source Type to cp_log

However none of the fields are properly searchable?

Do I have to use the Extract Fields process? When I tried this with a ; delimiter I get the error below, is this something I'm doing wrong? thanks for any help!

Error in 'rex' command: regex="(?ms)^(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))(?:\x3b)?(?P(?:"(?:[^\"]|.)"|(?:(?:(?!(?:\x3b)|\|").)|(?:.))))" has exceeded the configured depth_limit, consider raising the value in limits.conf.