All you need to do is install the add-on and make sure your CEF data's sourcetype is "cefevents" ... View more

@khourihan_splunk - the reason the add-on is not working for you is because your data doesn't comply with CEF format as defined in this document: there's a space before CEF Version field: CEF: 0|Imperva <...snip...> . | cefkv provides expected results once the space is removed: AlertNumber 62431 ApplicationName Multiple Description Distributed Malformed JSON Message EventID 1728628311230694325 Gateway kmj-us-p1-np-Nwafgw-3-222 QueryParameters ResponseCode 401 ServerGroup OrbisAZ-B URLMethod POST So you've got 2 solutions here: 1. Have your source send events with properly formatted CEF headers 2. Modify the regex in line 11 of $SPLUNK_HOME/apps/cefutils/bin/cefkv.py to match your headers. Sorry for the late answer. IMO that's still better than leaving the question unanswered ... BR --Igor ... View more

Hi, The add-on contains configurations that are used both at index time (Parsing/Merging pipelines) and at search time, so you need to install it on the Heavy Forwarders and on the Search Heads. Basically, what you need to do is to install the add-on all relevant Splunk instances (see above) and either: Modify the relevant inputs.conf on the Heavy Forwarder to set sourcetype for CEF logs collected by the HF to cefevents or copy the props.conf supplied with the add-on to $SPLUNK_HOME/etc/apps/cefutil/local and modify the stanza name to match your sourcetype or source. BR --Igor ... View more