All Apps and Add-ons

Extract fields from different security devices to a unified field format

vrajshekar
Path Finder

I am currently planning to forwards logs from multiple security devices to Splunk Enterprise.

 

I would like to know if its possible to extract fields from different log sources in a unified field format.

 

For Eg: I forward logs from Firewall, Proxy and Endpoint Security products. Since different vendors would be following different naming conventions in their logs. Is it possible to standardize this when parsing and indexing. From all these device logs, i want certain important fields.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Each source should be parsed and extracted separately.  When you do so, however, use the same field names for each source.  Then you can reference the common name regardless of the source.  This is how the Common Information Model (CIM) works (although you don't have to use the CIM app).

If you want to learn more about CIM, see https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Each source should be parsed and extracted separately.  When you do so, however, use the same field names for each source.  Then you can reference the common name regardless of the source.  This is how the Common Information Model (CIM) works (although you don't have to use the CIM app).

If you want to learn more about CIM, see https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Tags (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!