Not true - it is configurable.  Be aware tho changing the sourcetype using collect will be metered on ingestion licenses. ... View more

Oh I answered my own question.... I was going about it incorrectly, I needed to use SEDCMD rather than a transform. SEDCMD is also way easier and more straightforward but took a bit to get the syntax correct. The pipe's in the input were throwing me off, needed to escape them with a backslash replace top|otherClass| with just top| in all locations in the event (g) s/top\|otherClass\|/top\|/g Be sure you understand that this applies to _raw so make sure your match is specific and only ever matches that string. this is why i made sure to include the top| parameter. hopefully these don't move around arbitrarily 🙂 props.conf (on the indexer and search head--honestly not sure which worked) [ActiveDirectory] SEDCMD-fixObjectClass = s/top\|otherClass\|/top\|/g ... View more

Thank you! For some reason i didn't come across your answer in my searches. ... View more

We finally found a workaround. The loggrabber script never attempts to connect to port 18264 on the Checkpoint Server, but an strace revealed that it tries to open the CRL locally on the Splunk server from /etc/fw/conf/ICA.crl We configured a cron script that pulls an updated CRL list to this path. It now works. We are still stumbled when it comes to what changed on the Checkpoint server since this used to work before without the workaround. ... View more

We are now maintaining this TA to ensure its vetted and continues to parse (https://splunkbase.splunk.com/app/4238/) . We have a few updates happening over the next few days, so, please wait before downloading it .. but.. it is working well and vetted for cloud. ... View more